Release secrets-mcp 0.3.0: folder/type schema and MCP folder disambiguation

- Rename namespace/kind to folder/type on entries, audit_log, and history tables;
  add notes. Unique key is (user_id, folder, name).
- Service layer and MCP tools support name-first lookup with optional folder when
  multiple entries share the same name.
- secrets_delete dry_run uses the same disambiguation as real deletes.
- Add scripts/migrate-v0.3.0.sql for manual DB migration. Refresh README and
  AGENTS.md.

Made-with: Cursor

crates/secrets-mcp/src/web.rs

@@ -506,7 +506,7 @@ async fn audit_page(
         .map(|row| AuditEntryView {
             created_at_iso: row.created_at.to_rfc3339_opts(SecondsFormat::Secs, true),
             action: row.action,
-            target: format_audit_target(&row.namespace, &row.kind, &row.name),
+            target: format_audit_target(&row.folder, &row.entry_type, &row.name),
             detail: serde_json::to_string_pretty(&row.detail).unwrap_or_else(|_| "{}".to_string()),
         })
         .collect();
@@ -783,11 +783,15 @@ fn render_template<T: Template>(tmpl: T) -> Result<Response, StatusCode> {
     Ok(Html(html).into_response())
 }
 
-fn format_audit_target(namespace: &str, kind: &str, name: &str) -> String {
-    // Auth events reuse kind/name as a provider-scoped target, not an entry identity.
-    if namespace == "auth" {
-        format!("{}/{}", kind, name)
+fn format_audit_target(folder: &str, entry_type: &str, name: &str) -> String {
+    // Auth events (folder="auth") use entry_type/name as provider-scoped target.
+    if folder == "auth" {
+        format!("{}/{}", entry_type, name)
+    } else if !folder.is_empty() && !entry_type.is_empty() {
+        format!("[{}/{}] {}", folder, entry_type, name)
+    } else if !folder.is_empty() {
+        format!("[{}] {}", folder, name)
     } else {
-        format!("[{}/{}] {}", namespace, kind, name)
+        name.to_string()
     }
 }