feat(secrets): add local storage mode

[casey-brooks]

Summary

• add storage mode selection for secrets create/edit with local value handling
• prevent plaintext display by keeping local values masked/empty after creation
• update secrets list to show source and reference for local vs remote

Testing

• npm run lint
• npm run test
• npm run typecheck
• npm run build

Fixes #73

[casey-brooks]

Test & Lint Summary

• npm run lint (no errors)
• npm run test (13 files, 56 passed, 0 failed, 0 skipped)
• npm run typecheck (pass)
• npm run build (pass)

[noa-lucent]

Requesting changes.

Main blockers:

• Please avoid sending empty-string placeholders for mutually exclusive fields (value vs secretProviderId/remoteName). This is risky with proto3 optional/oneof presence and weakens the invariant. Build a discriminated union payload and omit irrelevant fields.
• Storage mode detection should reflect the invariant (remote requires BOTH providerId + remoteName). The current providerId || remoteName check masks partial/invalid states.

Nice-to-have:

• Update the remote name placeholder/help text to match the spec format.
• Consider surfacing missing provider IDs instead of falling back to a generic label.

Tests (recommended): add a minimal e2e asserting local secrets show "Built-in"/"Stored in console" and that plaintext values never appear in the list/edit UI.

[casey-brooks]

Summary:

• Tightened storage mode detection to require provider + remote name, surfacing invalid configs with clear labels and edit notices.
• Built create payloads as discriminated unions (no empty-string placeholders) and updated provider label fallbacks/remote name helper text.
• Added a minimal local-secret e2e to assert Built-in display and plaintext redaction.

Tests:

• npm run lint
• npm run test (56 passed)
• npm run typecheck
• VITE_OIDC_AUTHORITY=http://127.0.0.1:5000 VITE_OIDC_CLIENT_ID=console-app VITE_OIDC_SCOPE='openid profile email' npm run build
• E2E_BASE_URL=http://127.0.0.1:5000 E2E_OIDC_AUTHORITY=http://127.0.0.1:5000 E2E_OIDC_CLIENT_ID=console-app E2E_OIDC_SCOPE='openid profile email' METERING_GRPC_URL=http://127.0.0.1:50051 npm run test:e2e (32 passed)

[noa-lucent]

Re-review complete.

• Storage-mode inference now matches the invariant (remote requires provider+remote name; partial configs surfaced as invalid).
• Create payloads no longer send empty-string placeholders; irrelevant fields are omitted.
• Remote name UX updated to match the <mount>/<path>/<key> format.
• Added e2e coverage for local secrets (and verifies plaintext is not shown).

LGTM.

[casey-brooks]

Summary:

• Added Argos screenshots for local secrets list + edit dialog and create dialog storage modes (local/remote).
• Expanded secrets e2e coverage to capture create/edit UI states without exposing plaintext.

Tests:

• npm run lint
• npm run test (56 passed)
• npm run typecheck
• VITE_OIDC_AUTHORITY=http://127.0.0.1:5000 VITE_OIDC_CLIENT_ID=console-app VITE_OIDC_SCOPE='openid profile email' npm run build
• E2E_BASE_URL=http://127.0.0.1:5000 E2E_OIDC_AUTHORITY=http://127.0.0.1:5000 E2E_OIDC_CLIENT_ID=console-app E2E_OIDC_SCOPE='openid profile email' METERING_GRPC_URL=http://127.0.0.1:50051 npm run test:e2e (33 passed)

[noa-lucent]

Re-review complete.

New commit adds Argos screenshots for secrets create/edit flows. The screenshots don’t expose plaintext secret values (local value remains empty/masked), and the new create-dialog storage-mode coverage looks good.

LGTM.

[casey-brooks]

Summary:

• Replaced storage mode selector with a single Secret provider select (Built-in first) and aligned form logic/validation with built-in vs provider selection.
• Updated secrets create dialog e2e + Argos coverage for built-in/provider selections without plaintext.

Tests:

• npm run lint
• npm run test (56 passed)
• npm run typecheck
• VITE_OIDC_AUTHORITY=http://127.0.0.1:5000 VITE_OIDC_CLIENT_ID=console-app VITE_OIDC_SCOPE='openid profile email' npm run build
• E2E_BASE_URL=http://127.0.0.1:5000 E2E_OIDC_AUTHORITY=http://127.0.0.1:5000 E2E_OIDC_CLIENT_ID=console-app E2E_OIDC_SCOPE='openid profile email' METERING_GRPC_URL=http://127.0.0.1:50051 npm run test:e2e (33 passed)

[noa-lucent]

Re-review complete.

Reviewed latest UX change (single provider selector with Built-in first; no separate storage-mode selector).

• Provider selector cleanly represents storage modes (Built-in vs remote providers) and still enforces the mutual-exclusion invariant in validation + payload construction.
• Edit flow still prevents mode switching (Built-in <-> remote) via disabled options while allowing remote-only adjustments.
• Updated e2e coverage reflects the new UX and still asserts no plaintext display.

LGTM.