docs(connections): show a saved password and test a password source

connections/connection-form.mdx

@@ -31,7 +31,7 @@ The bar along the bottom carries **Test Connection**, **Cancel** and **Save**, p
 | **Socket** | Replaces Host and Port when **Connect Using** is **Socket**. The full path of the server's socket file, such as `/tmp/mysql.sock` |
 | **Database** | Optional on drivers that browse every database from one session. PostgreSQL and Redshift do not connect without one |
 | **Username** | Not pre-filled. Empty means the driver's own default |
-| **Password** | Stored in the macOS Keychain |
+| **Password** | Stored in the macOS Keychain. **Show password** reveals a saved one after Touch ID or your Mac's password. A connection whose password comes from a [password source](/features/connection-sharing#password-sources) shows the source here, with **Test Source** |
 | **Prompt for password** | Stores nothing, asks on every connect. Reads **Prompt for API token** on API-only drivers |
 | **Use Password File** | PostgreSQL, Redshift, and CockroachDB. Reads `~/.pgpass`, and reports underneath whether the file exists, has `chmod 0600`, and holds a matching line |
 

connections/credential-profiles.mdx

@@ -49,6 +49,8 @@ A linked connection keeps no password of its own. Linking deletes the one it had
 
 Pick **Saved in the Keychain** unless something else already owns the password. **Read from elsewhere** never leaves this Mac and never syncs.
 
+**Test Source** runs a **Read from elsewhere** source without connecting. It shows the password hidden, or the error with what the command printed to stderr. **Show password** reveals it after Touch ID or your Mac's password, and does the same for a password saved in the Keychain. A connection using the profile has its own **Test Source**, which fills in that connection's host, port, user and database.
+
 ## Additional secrets
 
 Some engines sign in with more than a password: an AWS secret access key, a Snowflake private key, a service account JSON. **Additional Secrets** in the profile editor lists them per database type. A connection reads only the secrets its own type declares, so one profile can carry several engines' keys without them colliding.

features/connection-sharing.mdx

@@ -154,7 +154,7 @@ Write `$VAR` or `${VAR}` in a `.tablepro` file and it resolves from TablePro's p
 
 ## Password sources
 
-A connection in `~/Library/Application Support/TablePro/connections.json` can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection.
+A connection in `~/Library/Application Support/TablePro/connections.json` can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection. Open the connection to see its source under **Password**, and click **Test Source** to run it without connecting.
 
 ```json
 { "passwordSource": { "kind": "file", "path": "~/.config/tablepro/secrets/feature-x.pw" } }