fix(dev): persist trusted rp secret after update

- store client_secret after trusted RP update responses
- add regression test for secret recovery on later detail fetch

backend/internal/handler/dev_handler.go

@@ -1085,6 +1085,15 @@ func (h *DevHandler) UpdateClient(c *fiber.Ctx) error {
 		return errorJSON(c, fiber.StatusInternalServerError, err.Error())
 	}
 
+	if updatedClient.ClientSecret != "" {
+		if h.SecretRepo != nil {
+			_ = h.SecretRepo.Upsert(c.Context(), updatedClient.ClientID, updatedClient.ClientSecret)
+		}
+		if h.Redis != nil {
+			_ = h.Redis.Set("client_secret:"+updatedClient.ClientID, updatedClient.ClientSecret, 0)
+		}
+	}
+
 	summary := h.mapClientSummary(*updatedClient)
 	return c.JSON(clientDetailResponse{
 		Client: summary,