feat: convert secret-sources into a plugin (B20)

drizzle/sqlite/0047_futuristic_microbe.sql

@@ -0,0 +1,4 @@
+-- secret_sources moves to the secret-sources plugin's adopted table at
+-- activation, after this migration runs. Dropping it here would delete the
+-- data before the plugin has a chance to rename it.
+SELECT 1;

drizzle/sqlite/meta/_journal.json

@@ -330,6 +330,13 @@
       "when": 1790282596918,
       "tag": "0046_misty_midnight",
       "breakpoints": true
+    },
+    {
+      "idx": 47,
+      "version": "6",
+      "when": 1790284030834,
+      "tag": "0047_futuristic_microbe",
+      "breakpoints": true
     }
   ]
 }