feat: implement subscription secrets management system (#250)

[rindicomfort]

Summary

Implements comprehensive secrets management for SubTrackr as described in issue #250.

Changes

backend/secrets/SecretsVault.ts

Acceptance Criterion	Implementation
Secrets vault	SecretsVault class — AsyncStorage-backed, values obfuscated (base64; swap-ready for AES-GCM), versioned manifest index
Secrets rotation	rotate(key, newValue) increments version + sets rotatedAt; getDueForRotation() returns secrets past their rotationIntervalMs
Environment-specific secrets	set/get/list all accept env: 'development' | 'staging' | 'production'; storage keys are namespaced per env
Secrets injection	inject(env?) returns a flat InjectedSecrets object (STELLAR_NETWORK, CONTRACT_ID, WEB3AUTH_CLIENT_ID, …) for app startup
Audit logging	Every set, get, rotate, delete, recover, inject writes an AuditEvent with timestamp, env, success flag, and optional reason; capped at 1000 events
Secrets recovery	Soft-delete via delete(); recover(key) restores the value and clears the deleted flag

backend/secrets/__tests__/SecretsVault.test.ts

• 25 tests covering all 6 acceptance criteria

Test Results

PASS backend/secrets/__tests__/SecretsVault.test.ts
  SecretsVault
    ✓ stores and retrieves a secret
    ✓ returns null for unknown secret
    ✓ value is not stored as plain text
    ✓ increments version on overwrite
    ✓ rotates a secret to a new value
    ✓ throws when rotating a non-existent secret
    ✓ identifies secrets due for rotation
    ✓ does not flag secrets not yet due
    ✓ isolates secrets by environment
    ✓ lists secrets for a specific environment only
    ✓ injects all env secrets into a flat object
    ✓ inject does not include deleted secrets
    ✓ soft-deletes a secret (get returns null)
    ✓ deleted secret excluded from listByEnv
    ✓ recovers a soft-deleted secret
    ✓ throws when recovering a non-existent secret
    ✓ logs set action
    ✓ logs get action
    ✓ logs failed get for missing secret
    ✓ logs rotate action
    ✓ logs delete action
    ✓ logs recover action
    ✓ logs inject action
    ✓ clears audit log
    ✓ audit log includes timestamp and env

Tests: 25 passed, 25 total

Acceptance Criteria

• Implement secrets vault (versioned, obfuscated, AsyncStorage-backed)
• Add secrets rotation (rotate(), getDueForRotation(), rotationIntervalMs)
• Support environment-specific secrets (dev/staging/prod isolation)
• Implement secrets injection (inject() → flat config object at startup)
• Add audit logging for secrets (all 6 actions logged with timestamp + env)
• Implement secrets recovery (soft-delete + recover())

Closes #250

[drips-wave]

@rindicomfort Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits