say when a stored token cannot be decrypted

The frame answered {"error":"internal error"} on every request. The cause was
AES-GCM failing with "Unsupported state or unable to authenticate data" — the
token in service_connections was encrypted under a key that no longer exists,
because the platform mints its encryption key on first use and does not back it
up. The same loss took slskd, memos and gitea credentials on this project's own
server earlier today.

It presented as a broken sidecar. connectionState reported `configured: true`
because a ROW exists, so the panel skipped the form and went to the frame,
where every call threw. Nothing offered a way to fix it, and the connection
form was unreachable precisely because it only appears when unconfigured.

Now a named failure. `UnreadableCredentials` is distinguished from every other
error — a database that is down keeps its own message, or a real fault would be
reported as "re-enter your token" — and the panel shows the form saying the key
changed, nothing else is lost, and the URL is still there.

Verified by the platform itself refusing to decrypt: this is the state that
machine has been in all day.

web/GiteaConnection.tsx

@@ -19,6 +19,15 @@ export type ConnectionState = {
   url?: string | null;
   user?: string | null;
   isOwner?: boolean;
+  /**
+   * A token is stored but cannot be decrypted.
+   *
+   * The platform's encryption key is minted on first use and not backed up, so losing it re-mints one
+   * and every previously encrypted column becomes unreadable. Reported separately from "not configured"
+   * because the person needs telling that nothing is broken and their URL is still there — only the
+   * token has to be pasted again.
+   */
+  unreadable?: boolean;
 };
 
 type Props = { state: ConnectionState; onSaved: () => void };
@@ -49,11 +58,13 @@ export const GiteaConnection = ({ state, onSaved }: Props) => {
   return (
     <div className="mx-auto flex h-full max-w-md flex-col justify-center gap-4 p-6">
       <div>
-        <h2 className="text-base font-semibold">Connect Gitea</h2>
+        <h2 className="text-base font-semibold">{state.unreadable ? 'Re-enter your token' : 'Connect Gitea'}</h2>
         <p className="mt-1 text-sm text-muted-foreground">
-          {state.isOwner === false
-            ? 'Your own access token. The instance is already set.'
-            : 'Where Gitea runs, and a token for it.'}
+          {state.unreadable
+            ? "The stored token can no longer be read — this server's encryption key changed. Nothing else is lost; paste it again."
+            : state.isOwner === false
+              ? 'Your own access token. The instance is already set.'
+              : 'Where Gitea runs, and a token for it.'}
         </p>
       </div>
 
@@ -74,13 +85,13 @@ export const GiteaConnection = ({ state, onSaved }: Props) => {
           type="password"
           value={token}
           onChange={(ev) => setToken(ev.target.value)}
-          placeholder={state.configured ? '•••••••• (unchanged)' : 'Settings → Applications in Gitea'}
+          placeholder={state.configured && !state.unreadable ? '•••••••• (unchanged)' : 'Settings → Applications in Gitea'}
         />
       </label>
 
       {error && <p className="text-xs text-destructive">{error}</p>}
 
-      <Button onClick={save} disabled={busy || (!state.configured && !token)}>
+      <Button onClick={save} disabled={busy || ((!state.configured || state.unreadable) && !token)}>
         {busy ? <Loader2 className="mr-2 h-3.5 w-3.5 animate-spin" /> : null}
         {state.configured ? 'Save' : 'Connect'}
       </Button>