secrets: a refused config value is not in the error

mounts.*.config is where a fetched credential lands, and pydantic
reports the value it refused as input_value. The create route answers
str(e) as its 400 detail, so an unparseable secret came back to a
caller whose only way to name it was a pointer. build_resource is the
one door every caller comes through, so the redaction sits there.