refactor: workspace secrets-core + secrets-mcp MCP SaaS

- Split library (db/crypto/service) and MCP/Web/OAuth binary
- Add deploy examples and CI/docs updates

Made-with: Cursor

crates/secrets-core/src/service/history.rs

@@ -0,0 +1,63 @@
+use anyhow::Result;
+use serde_json::Value;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+#[derive(Debug, serde::Serialize)]
+pub struct HistoryEntry {
+    pub version: i64,
+    pub action: String,
+    pub actor: String,
+    pub created_at: String,
+}
+
+pub async fn run(
+    pool: &PgPool,
+    namespace: &str,
+    kind: &str,
+    name: &str,
+    limit: u32,
+    _user_id: Option<Uuid>,
+) -> Result<Vec<HistoryEntry>> {
+    #[derive(sqlx::FromRow)]
+    struct Row {
+        version: i64,
+        action: String,
+        actor: String,
+        created_at: chrono::DateTime<chrono::Utc>,
+    }
+
+    let rows: Vec<Row> = sqlx::query_as(
+        "SELECT version, action, actor, created_at FROM entries_history \
+         WHERE namespace = $1 AND kind = $2 AND name = $3 \
+         ORDER BY id DESC LIMIT $4",
+    )
+    .bind(namespace)
+    .bind(kind)
+    .bind(name)
+    .bind(limit as i64)
+    .fetch_all(pool)
+    .await?;
+
+    Ok(rows
+        .into_iter()
+        .map(|r| HistoryEntry {
+            version: r.version,
+            action: r.action,
+            actor: r.actor,
+            created_at: r.created_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+        })
+        .collect())
+}
+
+pub async fn run_json(
+    pool: &PgPool,
+    namespace: &str,
+    kind: &str,
+    name: &str,
+    limit: u32,
+    user_id: Option<Uuid>,
+) -> Result<Value> {
+    let entries = run(pool, namespace, kind, name, limit, user_id).await?;
+    Ok(serde_json::to_value(entries)?)
+}