feat: lenient JSON options for secret payloads (enum names + case-insensitive)

[windischb]

Summary

Secret<T> previously (de)serialized its payload with JsonSerializerOptions.Default — case-sensitive, enums as ordinals. Enum-as-ordinal is fragile: if someone later reorders the enum, the stored number silently maps to a different member. This switches secret payloads to a shared, lenient SecretValueSerialization.Options:

• enums serialize as names (round-trip-safe against reordering)
• reading still accepts numeric enums and any property casing

Why it's safe for existing secrets

The change is strictly more permissive on read, so existing encrypted envelopes at rest (enum-as-number, PascalCase) stay fully readable — no migration. Only the in-memory form of newly serialized typed secret values changes (enum name instead of ordinal); the encrypted bytes at rest are produced by a separate encryptor path and are untouched.

Why a name/case-insensitive contract is the right default

Only the type-aware path inside the library (Secret<T> ctor) ever serializes a typed value (enum/object). Everything from outside — the CLI, hand-edited files, or a future browser encryptor — supplies plain JSON and would naturally send an enum's name. A name-based, case-insensitive contract handles all of those robustly. (The plaintext-config read path already used the lenient pipeline options; this aligns the decrypted-envelope path with it.)

Changes

• SecretValueSerialization.Options (case-insensitive + JsonStringEnumConverter), applied to Secret<T> ctor serialize + Open() deserialize.
• CLI encrypt --value help: pass enum names, not ordinals.
• 7 tests: enum name/number read, name-write (not ordinal), case-insensitive object, FromPlain round-trips (enum, record-with-enum, nullable enum).

Verification

• Full solution Release build: 0 errors
• Full test suite (excl. Performance): 616 passing, 0 failing (Secrets 135, incl. 7 new) — no regressions.

Notes

Independent of #47 (LocalStorage). This is a small, focused enabler that also makes the future browser-encrypted-secrets idea (and complex/enum secret authoring in general) far more forgiving.

🤖 Generated with Claude Code