fix(ui): validate secret manager settings and lock server-built lists

- SecretManagerLinks: validate settings when the integration token
  changes, and save only validated keys
- Service Domains: lock domainRows
- Server DockerImages: lock images

app/Livewire/Project/Service/Domains.php

@@ -49,6 +49,7 @@ class Domains extends Component
     public ?int $pendingRedirectServiceApplicationId = null;
 
     /** @var array<int, array<string, mixed>> */
+    #[Locked]
     public array $domainRows = [];
 
     public ?int $newServiceApplicationId = null;

app/Livewire/Project/Shared/SecretManagerLinks.php

@@ -8,6 +8,7 @@ use App\Support\ValidationPatterns;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Validation\ValidationException;
 use Livewire\Component;
 
 /**
@@ -124,7 +125,8 @@ class SecretManagerLinks extends Component
                 $this->settings = [];
             }
 
-            $settings = array_filter($this->settings, fn ($value) => filled($value));
+            $validated = $this->validate($this->tokenChangeRules());
+            $settings = array_filter(data_get($validated, 'settings', []), fn ($value) => filled($value));
 
             $this->resource->secretManagerLink()->updateOrCreate([], [
                 'integration_token_id' => $token->id,
@@ -138,11 +140,28 @@ class SecretManagerLinks extends Component
             $this->resetKeys();
             $this->loadData();
             $this->dispatch('success', 'Secret manager source saved. References resolve at the next deployment.');
+        } catch (ValidationException $e) {
+            throw $e;
         } catch (\Throwable $e) {
             handleError($e, $this);
         }
     }
 
+    /**
+     * The settings rules of the selected provider, with the fields still optional: a token is
+     * saved before the user fills in its settings.
+     *
+     * @return array<string, array<int, string>>
+     */
+    private function tokenChangeRules(): array
+    {
+        return collect($this->rules())
+            ->map(fn (array $rules, string $field): array => str_starts_with($field, 'settings.')
+                ? array_map(fn (string $rule): string => $rule === 'required' ? 'nullable' : $rule, $rules)
+                : $rules)
+            ->all();
+    }
+
     /**
      * Auto-save of the provider-specific settings fields (called on blur).
      */

app/Livewire/Server/DockerImages.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Server;
 
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class DockerImages extends Component
@@ -14,6 +15,10 @@ class DockerImages extends Component
 
     public array $parameters = [];
 
+    /**
+     * Images read from the server. Deletion checks container usage against this list.
+     */
+    #[Locked]
     public array $images = [];
 
     public ?array $usage = null;