fix(secrets): redact provider failure details

tests/test_caldav.py

@@ -593,6 +593,18 @@ class CalDAVSyncTests(unittest.TestCase):
         self.assertEqual((credential.metadata_ or {})["provider_ref"], provider_ref)
         self.assertIn(provider_ref, provider.values)
 
+        with patch("govoplan_calendar.backend.service.secret_provider", return_value=provider), patch.object(
+            provider,
+            "delete_secret",
+            side_effect=RuntimeError(f"provider failed for {provider_ref}"),
+        ):
+            with self.assertRaises(CalendarError) as raised:
+                delete_caldav_source(session, tenant_id="tenant-1", source_id=source.id)
+        self.assertNotIn(provider_ref, str(raised.exception))
+        session.rollback()
+        self.assertIsNone(source.deleted_at)
+        self.assertIsNone(credential.deleted_at)
+
     def test_disabling_auth_immediately_scrubs_and_audits_database_credential(self) -> None:
         session = self.session()
         session.add(Tenant(id="tenant-1", slug="tenant-1", name="Tenant"))