feat: bidirectional DB ↔ .env secrets sync + per-function env injection

[pyramation]

Summary

Adds bidirectional sync between .env and a new platform_secret_values DB table, plus refactors dev-compute.ts to inject only the required env vars per function.

DB Schema (pgpm migration)

New table constructive_infra_public.platform_secret_values:

(id uuid PK, secret_name text NOT NULL, configured_value text,
 database_id uuid NOT NULL, created_at timestamptz, updated_at timestamptz)
-- UNIQUE (secret_name, database_id)

Full deploy/revert/verify files following existing platform_secret_definitions patterns.

Backend API (www/server/index.ts)

New endpoints:

• GET /api/secret-values — read configured values from DB
• POST /api/secret-values — upsert configured values to DB
• POST /api/secrets/sync-from-db — DB → .env (merges DB values into existing .env)
• POST /api/secrets/sync-to-db — .env → DB (upserts all .env vars into platform_secret_values)

POST /api/env (existing Save) now also best-effort syncs to DB after writing .env.

Frontend (SecretsPanel.tsx)

Two new buttons: Sync from DB and Sync to DB in the secrets editor header, alongside the existing Save button. DB status indicator added.

Secrets Loading Pipeline (scripts/dev-compute.ts)

Refactored startup:

mergedSecrets = { ...DEFAULTS, ...dbSecrets, ...dotEnv }  // .env > DB > defaults

• loadDbSecretValues(dbName) queries platform_secret_values for configured values
• loadFunctionRequirements(dbName) now returns { name, required } per requirement
• buildFunctionEnv(fnName) injects systemEnv + only needed secrets/configs (not the whole env)
• validateRequirements() fails fast on missing required=true, warns on optional

CLI

• make secrets:sync — runs scripts/secrets-sync.sh for bidirectional .env ↔ DB sync
• scripts/secrets-sync.sh — bash script: reads .env → upserts to DB, then reads DB → merges new values into .env

Link to Devin session: https://app.devin.ai/sessions/ad8f831705e84add8d25804094ae6d79
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring