feat: 1Password Connect secret sources for SSH credentials (#1341)

* feat: 1Password Connect secret sources for SSH credentials

Hosts and credentials can hold op://vault/item/field references instead
of secrets; they are resolved at connect time from the user's secret
source (1Password Connect) at the single point where every subsystem
receives plaintext credentials, so terminal, SFTP, Docker, metrics and
tunnels all work without per-subsystem changes. Sources are per user,
optionally shared, with the access token encrypted under the owner's
data key; resolved values are cached briefly in memory.

* style: format secret source changes

drizzle/mysql/0017_spicy_proteus.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `secret_sources` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`kind` text NOT NULL DEFAULT ('onepassword-connect'),
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` boolean NOT NULL DEFAULT false,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `secret_sources_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `secret_sources` ADD CONSTRAINT `secret_sources_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);

drizzle/mysql/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1787581983770,
       "tag": "0016_unusual_tyrannus",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "5",
+      "when": 1787596414390,
+      "tag": "0017_spicy_proteus",
+      "breakpoints": true
     }
   ]
 }

drizzle/postgres/0017_curved_pet_avengers.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "secret_sources" (
+	"id" varchar(255) PRIMARY KEY NOT NULL,
+	"user_id" varchar(255) NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"kind" text DEFAULT 'onepassword-connect' NOT NULL,
+	"base_url" text NOT NULL,
+	"token" text NOT NULL,
+	"shared" boolean DEFAULT false NOT NULL,
+	"created_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	"updated_at" varchar(255) DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "secret_sources" ADD CONSTRAINT "secret_sources_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "idx_secret_sources_user" ON "secret_sources" USING btree ("user_id");

drizzle/postgres/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1787581981251,
       "tag": "0016_slippery_anita_blake",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1787596411353,
+      "tag": "0017_curved_pet_avengers",
+      "breakpoints": true
     }
   ]
 }

drizzle/sqlite/0013_tranquil_master_mold.sql

@@ -0,0 +1,14 @@
+CREATE TABLE `secret_sources` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`name` text NOT NULL,
+	`kind` text DEFAULT 'onepassword-connect' NOT NULL,
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` integer DEFAULT false NOT NULL,
+	`created_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	`updated_at` text DEFAULT CURRENT_TIMESTAMP NOT NULL,
+	FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);

drizzle/sqlite/meta/_journal.json

@@ -92,6 +92,13 @@
       "when": 1787581978969,
       "tag": "0012_yellow_firedrake",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1787596405780,
+      "tag": "0013_tranquil_master_mold",
+      "breakpoints": true
     }
   ]
 }