Secure Send hands over a message, not a bare URL

A link on its own invites being pasted onto text that is already in the chat
box, and every chat client turns the selection into the link's caption. The
secret then travels as the visible message with the secure link wrapped around
it, protecting nothing.

This is not hypothetical. Six LAPS passwords went out that way in production -
machine names and passwords as the caption, the correct /s/<token>#<key> URL
underneath, doing nothing at all.

Copy message puts a whole sentence on the clipboard: what the link is, how many
opens it has, when it expires, and then the URL. A sentence has nowhere to
attach itself - pasted into an empty box it is a message, pasted over a
selection it replaces it rather than decorating it. Plain text on purpose; a
rich-text flavour is exactly what would let a secret ride along as markup.

The success card now says to delete the password from the chat box before
pasting. The existing hint explains that the key cannot be recovered, which is
true and does not stop anybody pasting the password itself.

Nothing about the link was wrong and nothing about it changed: the URL carries
the token, the key rides in the fragment the browser never sends, the plaintext
is dropped the moment it is sealed, and redeeming stays a POST so a preview
cannot spend it.

CHANGELOG.md

@@ -128,6 +128,17 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **Secure Send now hands you a message, not a bare URL.** A link on its own
+  invites being pasted onto text already sitting in the chat box, and a chat
+  client turns the selection into the link's caption - so the secret travels as
+  the visible message and the link beside it protects nothing. That happened in
+  production: six LAPS passwords sent as the caption of a link whose whole job
+  was to keep them out of the chat. Copy message puts a sentence on the
+  clipboard instead, which has nowhere to attach itself, and the success card
+  now says plainly to delete the password from the chat box before pasting.
+  Nothing about the link itself was wrong - the URL carries only the token, the
+  key rides in the fragment, and neither ever reached the message.
+
 - **Ticking a section off crossed out its title and nothing else.** The strike
   now covers everything under that heading, including its sub-sections, which
   is what "this section is done" means to somebody who ticked the thing that