feat(nn): entry–secret N:N, unique secret names, web unlink

Bump secrets-mcp to 0.3.8 (tag 0.3.7 already used).

- Junction table entry_secrets; secrets user-scoped with type
- Per-user unique secrets.name; link_secret_names on add
- Manual migrations + migrate script; MCP/tool and Web updates

Made-with: Cursor

crates/secrets-core/src/models.rs

@@ -27,8 +27,11 @@ pub struct Entry {
 #[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
 pub struct SecretField {
     pub id: Uuid,
-    pub entry_id: Uuid,
-    pub field_name: String,
+    pub user_id: Option<Uuid>,
+    pub name: String,
+    #[serde(rename = "type")]
+    #[sqlx(rename = "type")]
+    pub secret_type: String,
     /// AES-256-GCM ciphertext: nonce(12B) || ciphertext+tag
     pub encrypted: Vec<u8>,
     pub version: i64,
@@ -83,7 +86,7 @@ impl From<&EntryWriteRow> for EntryRow {
 #[derive(Debug, sqlx::FromRow)]
 pub struct SecretFieldRow {
     pub id: Uuid,
-    pub field_name: String,
+    pub name: String,
     pub encrypted: Vec<u8>,
 }