Snapshot import asks for a credential secret it never uses when flows are excluded #8570

POST /api/v1/snapshots/import with components: { flows: false } and a snapshot carrying encrypted credentials returns 400 Credential secret is required when importing a snapshot with credentials.

But uploadSnapshot forces components.credentials = false whenever components.flows === false, and replaces the flows with { flows: [], credentials: {} }, so the credentials are never decrypted and the secret is never used.

The guard in the route only looks at components.credentials:

if (request.body.components?.credentials !== false) {
    if (snapshot.flows.credentials?.$ && !request.body.credentialSecret) {

components: { credentials: false } works fine, it's only flows: false that trips. Might just need the same flows === false short-circuit the controller already does.