Detailed view of a single Connection — extends {@link ConnectionSummaryDTO ConnectionSummaryDTO} with the sealed config serialized to a free-form JSON object (<code>Map<String, Object></code> → <code>type: object, additionalProperties: true</code> in the spec, so it round-trips through client codegen). NEVER carries credentials: the encrypted credential blob stays inside the entity, and every secret-bearing key of the config itself is stripped by <code>redactSensitive</code> before serialization.

<p><b>Why redact here and not with <code>@JsonIgnore</code> on the record component?</b> The very same <code>ObjectMapper</code> bean serializes <code>ConnectionConfig</code> into the JSONB <code>connection.config</code> column (Hibernate's <code>json_format_mapper</code> is wired to it in <code>HibernateJacksonFormatMapperConfig</code>). Annotating the component would therefore drop the secret on write and destroy the stored value — the API-boundary filter below is the only place the two concerns can be separated. <p>Mirroring the summary fields (rather than embedding the summary record) keeps the JSON shape flat — the API consumer sees one record, not a nested <code>summary</code> object.