Sanitize Helpdesk mail settings for all projects

docs/redmineup_local_fork_changelog.md

@@ -32,6 +32,27 @@ environment. Before risky edits, archive the current plugin directories in
   - Run `validate_helpdesk_outbox_worker.py` after outbox or worker changes,
     then choose the external index target.
 
+## 2026-04-25 - Test Helpdesk Credential Sanitization
+
+- Touched areas:
+  - Test instance post-import tooling
+  - Post-import validation
+- Purpose:
+  - Ensure production database imports cannot leave real Helpdesk POP3/SMTP
+    credentials on projects where Helpdesk is disabled but settings rows still
+    exist.
+- Behavior changed:
+  - `reset_helpdesk_mail_settings.py` now rewrites Helpdesk mail settings for
+    every active project, not only projects with `contacts_helpdesk` enabled.
+  - `validate_test_instance.py` checks every active project for Mailpit
+    Helpdesk settings.
+- LAN test result:
+  - `./reset_helpdesk_mail_settings.py --dry-run` matched 52 active projects.
+  - `./reset_helpdesk_mail_settings.py` updated 1,092 setting rows across 52
+    active projects.
+  - `./validate_test_instance.py` passed and reported 52 active projects with
+    matching Mailpit Helpdesk settings.
+
 ## 2026-04-25 - Outbox Worker Processing Policy
 
 - Touched areas: