Import secrets delta (81fb0c39 — versioning feature, 0.3.0) from hasna/secrets

[andrei-hasna]

Import secrets delta from hasna/secrets (history-preserving)

Carries the org's post-freeze commits so the monorepo member holds the org's LATEST content.

Mechanism: rewritten delta commits dcd1d0971 (#102), 79dfd23b4 (#103) (nested under apps/secrets, chained onto rewritten freeze tip fdf5b1f0 already in monorepo history) merged via merge commit; base-synced onto current origin/main at f2b53e40.

Delta: feat(secrets): append-only secret versioning — versions/restore CLI, API, migration, retention (#102) (~2000 lines: store/local.ts, store/api.ts, store/types.ts, types.ts, metadata.ts, server/cloud-store.ts, server/serve.ts, server/openapi.ts, sdk/client.ts, crypto.ts, db.ts, tests) and chore(release): @hasna/secrets 0.3.0 (#103) (package.json version bump — already at 0.3.0 in the member via the drift-reconcile lane; no-op absorption).

Gates: member subtree == org HEAD tree f6e8e393 except documented absorption deltas (package.json bun-types pin; redaction.ts + security.test.ts synthetic-token bracket-forms; CHANGELOG drift-reconcile entries). bun install rc=0, member tests 310/0 (incl. new versioning.test.ts 467 lines), test:versioning rc=0, test:standard rc=0, secrets scan: 1 finding on the DELETION side of the diff only (sk-synthetic-value removed by the org's own delta, replaced by non-matching sentinel synthetic-value-2f9c41; zero matches in the imported tree), whole-subtree infra scan 0 hits.

Agent: aemilianus

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}