Submit or update portal credentials for a brand+portal combination.

Payload from PortalConfigDialog.js: { "brand_id": 1, "pv_id": 10, (optional) "platform_slug": "standvirtual", "credentials": { "client_id": "...", "client_secret": "...", ... } }

The submission is applied to the brand's Integrazu account and validated there (/apis/create|update then /apis/check-auth), so the response already carries the verdict:

{"success": true, "status": "synced"|"auth_failed"|"disabled"|...,
 "auth_ok": bool|null, "written": bool, "retype": bool,
 "missing": [...], "message": "<PT-PT, actionable>"}

⛔ A portal that is already connected is only changed with every secret of it typed in THIS request (apis_config.push_portal_config — the export_vin fix, 2026-09-30). A change without them comes back missing_fields with retype: true: the dialog asks for exactly those again.

No ticket, no admin review — see the module docstring for what this replaced.

GOVERNING PRINCIPLE: the credentials are the product, the push is the follow-up. The upsert commits first; _push_and_record is guarded and cannot raise. A 200 with status: "not_sent" means "saved, not applied yet" — never a 5xx on a submission that succeeded.