feat(secrets): group-owned, env-scoped secrets + inherited resolution

Migration 0049 reshapes `secrets` to the same polymorphic-owner contract
as `vars` (0048): a secret is owned by an app XOR an ancestor group,
carries an `environment_scope`, and the old PK `(app_id, name)` becomes
two partial-unique indexes `(owner, environment_scope, name)`. Existing
rows backfill to `app_id` + scope `'*'`; the v1 AAD does NOT include the
scope, so every current ciphertext keeps decrypting byte-for-byte.

`SecretsRepo` is generalised to be owner+scope keyed (`SecretOwner` moves
down from `secrets_service` and is re-exported for path stability). The
SDK read path now goes through `SecretsRepo::resolve`, which reuses the
shared `CHAIN_LEVELS_CTE` to walk app→ancestor-group→root, env-filters,
and takes the nearest level (`@E` beating `*` within a level) — returning
the winning owner so the value is decrypted under the AAD it was sealed
with. Runtime injection stays anchored to `cx.app_id`: an app only ever
resolves its own and its ancestors' secrets.

All callers updated to owner+scope (`SecretOwner::App(_)`, scope `'*'`):
the app-secrets admin API, the SDK service, and the apply email-secret
path. The 21 secrets unit tests (incl. the app/group AAD-disjointness and
cross-row swap proofs) stay green; the chain-walk was live-verified
against Postgres (nearest-wins + env-filter). Admin API for group secrets
and the masked-read endpoint land next (Step E).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/secrets_api.rs

@@ -25,9 +25,12 @@ use serde_json::json;
 
 use crate::app_repo::AppRepository;
 use crate::authz::{require, AuthzDenied, AuthzError, AuthzRepo, Capability};
-use crate::secrets_repo::{SecretsRepo, SecretsRepoError};
+use crate::secrets_repo::{SecretOwner, SecretsRepo, SecretsRepoError};
 use crate::secrets_service::seal;
 
+/// App secrets are env-agnostic; only group secrets carry a concrete scope.
+const APP_SECRET_SCOPE: &str = "*";
+
 #[derive(Clone)]
 pub struct SecretsState {
     pub repo: Arc<dyn SecretsRepo>,
@@ -82,7 +85,11 @@ async fn list_secrets(
     .await?;
     let page = s
         .repo
-        .list_meta(app_id, q.cursor.as_deref(), q.limit.unwrap_or(0))
+        .list_meta(
+            SecretOwner::App(app_id),
+            q.cursor.as_deref(),
+            q.limit.unwrap_or(0),
+        )
         .await?;
     Ok(Json(ListSecretsResponse {
         secrets: page
@@ -121,15 +128,23 @@ async fn set_secret(
     validate_secret_name(&input.name)?;
     // Audit 2026-06-11 H-D1 — v1 envelope with AAD bound to
     // (app_id, name). Same path as the SDK secrets::set.
+    let owner = SecretOwner::App(app_id);
     let (ciphertext, nonce, version) = seal(
         &s.master_key,
-        crate::secrets_service::SecretOwner::App(app_id),
+        owner,
         &input.name,
         &input.value,
         s.max_value_bytes,
     )?;
     s.repo
-        .set(app_id, &input.name, &ciphertext, &nonce, version)
+        .set(
+            owner,
+            APP_SECRET_SCOPE,
+            &input.name,
+            &ciphertext,
+            &nonce,
+            version,
+        )
         .await?;
     Ok(StatusCode::NO_CONTENT)
 }
@@ -146,7 +161,11 @@ async fn delete_secret(
         Capability::AppSecretsWrite(app_id),
     )
     .await?;
-    if !s.repo.delete(app_id, &name).await? {
+    if !s
+        .repo
+        .delete(SecretOwner::App(app_id), APP_SECRET_SCOPE, &name)
+        .await?
+    {
         return Err(SecretsApiError::NotFound);
     }
     Ok(StatusCode::NO_CONTENT)