feat: secrets CLI MVP — add/search/delete with PostgreSQL JSONB

- Single `secrets` table with namespace/kind/name/tags/metadata/encrypted
- Auto-migrate on startup using uuidv7() primary keys and GIN indexes
- CLI commands: add (upsert, @file support), search (full-text + tags), delete
- Multi-platform Gitea Actions: debian (x86_64-musl), darwin-arm64, windows
  - continue-on-error + timeout-minutes=30 for offline runner tolerance
- VS Code tasks.json for local build/test/seed
- AGENTS.md for AI context

Made-with: Cursor

src/commands/add.rs

@@ -0,0 +1,87 @@
+use anyhow::Result;
+use serde_json::{Map, Value};
+use sqlx::PgPool;
+use std::fs;
+
+/// Parse "key=value" entries. Value starting with '@' reads from file.
+fn parse_kv(entry: &str) -> Result<(String, String)> {
+    let (key, raw_val) = entry.split_once('=').ok_or_else(|| {
+        anyhow::anyhow!(
+            "Invalid format '{}'. Expected: key=value or key=@file",
+            entry
+        )
+    })?;
+
+    let value = if let Some(path) = raw_val.strip_prefix('@') {
+        fs::read_to_string(path)
+            .map_err(|e| anyhow::anyhow!("Failed to read file '{}': {}", path, e))?
+    } else {
+        raw_val.to_string()
+    };
+
+    Ok((key.to_string(), value))
+}
+
+fn build_json(entries: &[String]) -> Result<Value> {
+    let mut map = Map::new();
+    for entry in entries {
+        let (key, value) = parse_kv(entry)?;
+        map.insert(key, Value::String(value));
+    }
+    Ok(Value::Object(map))
+}
+
+pub async fn run(
+    pool: &PgPool,
+    namespace: &str,
+    kind: &str,
+    name: &str,
+    tags: &[String],
+    meta_entries: &[String],
+    secret_entries: &[String],
+) -> Result<()> {
+    let metadata = build_json(meta_entries)?;
+    let encrypted = build_json(secret_entries)?;
+
+    sqlx::query(
+        r#"
+        INSERT INTO secrets (namespace, kind, name, tags, metadata, encrypted, updated_at)
+        VALUES ($1, $2, $3, $4, $5, $6, NOW())
+        ON CONFLICT (namespace, kind, name)
+        DO UPDATE SET
+            tags      = EXCLUDED.tags,
+            metadata  = EXCLUDED.metadata,
+            encrypted = EXCLUDED.encrypted,
+            updated_at = NOW()
+        "#,
+    )
+    .bind(namespace)
+    .bind(kind)
+    .bind(name)
+    .bind(tags)
+    .bind(&metadata)
+    .bind(&encrypted)
+    .execute(pool)
+    .await?;
+
+    println!("Added: [{}/{}] {}", namespace, kind, name);
+    if !tags.is_empty() {
+        println!("  tags:     {}", tags.join(", "));
+    }
+    if !meta_entries.is_empty() {
+        let keys: Vec<&str> = meta_entries
+            .iter()
+            .filter_map(|s| s.split_once('=').map(|(k, _)| k))
+            .collect();
+        println!("  metadata: {}", keys.join(", "));
+    }
+    if !secret_entries.is_empty() {
+        let keys: Vec<&str> = secret_entries
+            .iter()
+            .filter_map(|s| s.split_once('=').map(|(k, _)| k))
+            .collect();
+        println!("  secrets:  {}", keys.join(", "));
+    }
+
+    Ok(())
+}