feat: secrets CLI MVP — add/search/delete with PostgreSQL JSONB

- Single `secrets` table with namespace/kind/name/tags/metadata/encrypted
- Auto-migrate on startup using uuidv7() primary keys and GIN indexes
- CLI commands: add (upsert, @file support), search (full-text + tags), delete
- Multi-platform Gitea Actions: debian (x86_64-musl), darwin-arm64, windows
  - continue-on-error + timeout-minutes=30 for offline runner tolerance
- VS Code tasks.json for local build/test/seed
- AGENTS.md for AI context

Made-with: Cursor

.vscode/tasks.json

@@ -0,0 +1,107 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "build",
+      "type": "shell",
+      "command": "cargo build",
+      "group": { "kind": "build", "isDefault": true }
+    },
+    {
+      "label": "cli: version",
+      "type": "shell",
+      "command": "./target/debug/secrets -V",
+      "dependsOn": "build"
+    },
+    {
+      "label": "cli: help",
+      "type": "shell",
+      "command": "./target/debug/secrets --help",
+      "dependsOn": "build"
+    },
+    {
+      "label": "cli: help add",
+      "type": "shell",
+      "command": "./target/debug/secrets help add",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search all",
+      "type": "shell",
+      "command": "./target/debug/secrets search",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search by namespace (refining)",
+      "type": "shell",
+      "command": "./target/debug/secrets search -n refining",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search by namespace (ricnsmart)",
+      "type": "shell",
+      "command": "./target/debug/secrets search -n ricnsmart",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search servers",
+      "type": "shell",
+      "command": "./target/debug/secrets search --kind server",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search services",
+      "type": "shell",
+      "command": "./target/debug/secrets search --kind service",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search keys",
+      "type": "shell",
+      "command": "./target/debug/secrets search --kind key",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search by tag (aliyun)",
+      "type": "shell",
+      "command": "./target/debug/secrets search --tag aliyun",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search by tag (hongkong)",
+      "type": "shell",
+      "command": "./target/debug/secrets search --tag hongkong",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search keyword (gitea)",
+      "type": "shell",
+      "command": "./target/debug/secrets search -q gitea",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: search with secrets revealed",
+      "type": "shell",
+      "command": "./target/debug/secrets search -n refining --kind service --name gitea --show-secrets",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: combined search (ricnsmart + server + shanghai)",
+      "type": "shell",
+      "command": "./target/debug/secrets search -n ricnsmart --kind server --tag shanghai",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: add + delete roundtrip",
+      "type": "shell",
+      "command": "echo '--- add ---' && ./target/debug/secrets add -n test --kind demo --name roundtrip-test --tag test -m foo=bar -s password=secret123 && echo '--- search ---' && ./target/debug/secrets search -n test --show-secrets && echo '--- delete ---' && ./target/debug/secrets delete -n test --kind demo --name roundtrip-test && echo '--- verify deleted ---' && ./target/debug/secrets search -n test",
+      "dependsOn": "build"
+    },
+    {
+      "label": "test: add with file secret",
+      "type": "shell",
+      "command": "echo '--- add key from file ---' && ./target/debug/secrets add -n test --kind key --name test-key --tag test -s content=@./refining/keys/Vultr && echo '--- verify ---' && ./target/debug/secrets search -n test --kind key --show-secrets && echo '--- cleanup ---' && ./target/debug/secrets delete -n test --kind key --name test-key",
+      "dependsOn": "build"
+    }
+  ]
+}