Fix: PUT /apps/:id can update mac fields when write_secrets scope authorized