docs(campaign): clarify legacy mail secret treatment

docs/MAIL_PROFILE_BOUNDARY.md

@@ -57,10 +57,12 @@ Campaign authors need `mail:profile:use` in addition to the relevant Campaign
 permission. Profile visibility remains governed by Mail policy and campaign
 owner context.
 
-## Legacy versions and migration
+## Existing database rows and migration
 
-Older versions can contain inline SMTP/IMAP settings or credentials. GovOPlaN
-does not delete or rewrite those stored audit records automatically:
+The current database can contain campaign versions with inline SMTP/IMAP
+settings or credentials. There is no separate historical Campaign JSON corpus
+to import or remediate. GovOPlaN treats those inline fields as inert legacy
+material and does not delete or rewrite the stored audit rows automatically:
 
 - API responses omit all legacy transport fields and secrets and expose a
   `mail_profile_migration_required` marker.
@@ -72,11 +74,12 @@ does not delete or rewrite those stored audit records automatically:
 - a locked version remains unchanged. Creating its editable successor records
   the migration while retaining the locked source as audit evidence.
 
-Legacy execution snapshots are likewise retained for audit but cannot be used
-for delivery. Revalidate and rebuild an editable profile-only version. Removing
-the remaining live and backup secret copies requires the separately approved
-remediation in
-[`govoplan-campaign#77`](https://git.add-ideas.de/add-ideas/govoplan-campaign/issues/77).
+Legacy execution snapshots are likewise retained but cannot be used for
+delivery. Revalidate and rebuild an editable profile-only version. Normal
+database backup, restore, encryption, and access controls apply to the current
+database as a whole; the product does not define a separate historical-JSON or
+inline-secret recovery workflow. A restored legacy row remains inert and
+fail-closed under the same rules.
 
 ## Operator checks