fn expose_optional_secret(secret: &Option<SecretString>) -> &str
Helper function to extract secret string from Option. Returns empty string if None.