- Closed patch-coverage gaps flagged on PR #2126: added CT tests for `ToolSecretsPanel`'s save/delete failure and network-error branches, provider-select change, and blank-API-key save; added CT tests for `EnricherChainEditor`'s move-up/derived-display-name paths and `SystemSettings`'s null-`preferredEnrichers` fallback and clear-last-enricher-for-a-mimetype path. Extracted `EnricherChainEditor`'s reorder/append bounds-checking into `reorderChain`/`appendToChain` (`frontend/src/components/admin/system_settings/utils.ts`) with direct Vitest unit tests, since the original inline guards were only reachable from `<IconButton disabled>`/`<Button disabled>` click handlers that Playwright can't trigger.
