feat(nn): entry–secret N:N, unique secret names, web unlink

Bump secrets-mcp to 0.3.8 (tag 0.3.7 already used).

- Junction table entry_secrets; secrets user-scoped with type
- Per-user unique secrets.name; link_secret_names on add
- Manual migrations + migrate script; MCP/tool and Web updates

Made-with: Cursor

crates/secrets-core/src/service/env_map.rs

@@ -51,7 +51,7 @@ async fn build_entry_env_map(
     } else {
         all_fields
             .iter()
-            .filter(|f| only_fields.contains(&f.field_name))
+            .filter(|f| only_fields.contains(&f.name))
             .collect()
     };
 
@@ -63,7 +63,7 @@ async fn build_entry_env_map(
         let key = format!(
             "{}_{}",
             effective_prefix,
-            f.field_name.to_uppercase().replace(['-', '.'], "_")
+            f.name.to_uppercase().replace(['-', '.'], "_")
         );
         map.insert(key, json_to_env_string(&decrypted));
     }
@@ -97,7 +97,7 @@ async fn build_entry_env_map(
                 let key_var = format!(
                     "{}_{}",
                     key_prefix,
-                    f.field_name.to_uppercase().replace(['-', '.'], "_")
+                    f.name.to_uppercase().replace(['-', '.'], "_")
                 );
                 map.insert(key_var, json_to_env_string(&decrypted));
             }