v0.38.1

Secret attach options: credentials pass inline

Documentation-only patch; no behaviour change.

The DuckDB extension will not have a vgi_attach secret type, so the docs and docstrings no longer mention one. Credential options (API keys, tokens, passwords) must still be declared secret=True. They are passed inline as attach options. The extension redacts them from duckdb_databases(), keeps only a salted hash of them in its cache key, and never logs them. To keep a credential out of the SQL text, write the option as an expression:

ATTACH 'sales' (TYPE vgi, LOCATION 'https://worker.example.com', api_key getenv('SALES_API_KEY'));