Fix legacy discovery_type deserialization

Add custom Deserialize impl for ResolvableSecret that accepts both
the current tagged-enum format and pre-v0.15.0 plain strings stored
in discovery_type JSONB. Prevents deserialization failure on upgrade
from instances with existing Network discovery records.

Author: mayanayza

backend/src/server/credentials/impl/mapping.rs

@@ -183,13 +183,47 @@ pub enum ResolvableValue {
 
 /// Secret value — inline or file path. Daemon wraps resolved value in Secret<String>.
 /// Never logged in plaintext.
-#[derive(Debug, Clone, Serialize, Deserialize, Eq, PartialEq, Hash, ToSchema)]
+///
+/// Custom Deserialize accepts both the current tagged-enum format
+/// (`{"mode":"Value","value":"..."}`) and legacy plain strings (`"********"`)
+/// from pre-v0.15.0 discovery_type JSONB. Legacy strings deserialize as
+/// `Value { value: string }`.
+#[derive(Debug, Clone, Serialize, Eq, PartialEq, Hash, ToSchema)]
 #[serde(tag = "mode")]
 pub enum ResolvableSecret {
     Value { value: String },
     FilePath { path: String },
 }
 
+impl<'de> Deserialize<'de> for ResolvableSecret {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let value = serde_json::Value::deserialize(deserializer)?;
+        match &value {
+            serde_json::Value::String(s) => Ok(ResolvableSecret::Value { value: s.clone() }),
+            serde_json::Value::Object(_) => {
+                #[derive(Deserialize)]
+                #[serde(tag = "mode")]
+                enum Tagged {
+                    Value { value: String },
+                    FilePath { path: String },
+                }
+                let tagged: Tagged =
+                    serde_json::from_value(value).map_err(serde::de::Error::custom)?;
+                Ok(match tagged {
+                    Tagged::Value { value } => ResolvableSecret::Value { value },
+                    Tagged::FilePath { path } => ResolvableSecret::FilePath { path },
+                })
+            }
+            _ => Err(serde::de::Error::custom(
+                "expected string or object for ResolvableSecret",
+            )),
+        }
+    }
+}
+
 impl ResolvableValue {
     /// Resolve to a string value. FilePath variant reads from disk.
     pub fn resolve(&self, field_name: &str, label: &str) -> Result<String, anyhow::Error> {

backend/src/server/credentials/impl/types/snmp.rs

@@ -274,6 +274,21 @@ mod tests {
         assert_eq!(community_value(&roundtripped), "my-secret");
     }
 
+    #[test]
+    fn legacy_string_community_deserializes() {
+        // Pre-v0.15.0 discovery_type JSONB stored community as a plain string
+        // (redacted via Secret<String> serialize). The custom ResolvableSecret
+        // deserializer must accept this format.
+        let json = r#"{"version":"V2c","community":"********"}"#;
+        let cred: SnmpQueryCredential = serde_json::from_str(json).unwrap();
+        assert_eq!(
+            cred.community,
+            ResolvableSecret::Value {
+                value: "********".to_string()
+            }
+        );
+    }
+
     #[test]
     fn specificity_ordering() {
         let ip: IpAddr = "10.0.0.1".parse().unwrap();