feat: convert secret-sources into a plugin (B20)

src/backend/database/db/schema.ts

@@ -1027,38 +1027,6 @@ export const syncTombstones = sqliteTable("sync_tombstones", {
 
 // --- collab rooms ---
 
-// --- secret sources ---
-
-/**
- * An external password manager Termix pulls secrets from at connect time,
- * instead of storing them. Only the access token is secret; it is encrypted
- * with the owner's data key under the row id. Hosts and credentials refer to
- * entries by reference ("op://vault/item/field") in their secret fields.
- */
-export const secretSources = sqliteTable(
-  "secret_sources",
-  {
-    id: text("id").primaryKey(),
-    userId: text("user_id")
-      .notNull()
-      .references(() => users.id, { onDelete: "cascade" }),
-    name: text("name").notNull(),
-    // "onepassword-connect" for now; the reference syntax is per kind.
-    kind: text("kind").notNull().default("onepassword-connect"),
-    baseUrl: text("base_url").notNull(),
-    token: text("token").notNull(),
-    // Visible to every user; secrets still decrypt with the owner's key.
-    shared: integer("shared", { mode: "boolean" }).notNull().default(false),
-    createdAt: text("created_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-    updatedAt: text("updated_at")
-      .notNull()
-      .default(sql`CURRENT_TIMESTAMP`),
-  },
-  (table) => [index("idx_secret_sources_user").on(table.userId)],
-);
-
 // --- credential sharing ---
 
 /**