feat(FN-009): implement config and secrets management with runtime injection

- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow

apps/api/app/schemas/secret.py

@@ -1,7 +1,13 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
 from uuid import UUID
 
 from app.schemas.base import OrmBase
 
+if TYPE_CHECKING:
+    from app.models.secret import Secret
+
 
 class SecretBase(OrmBase):
     scope_type: str
@@ -15,7 +21,17 @@ class SecretCreate(SecretBase):
 
 class SecretRead(SecretBase):
     id: UUID
-    value: str
+    value: str = "••••••"
+
+    @classmethod
+    def from_secret(cls, secret: Secret) -> SecretRead:
+        return cls(
+            id=secret.id,
+            scope_type=secret.scope_type,
+            scope_id=secret.scope_id,
+            key=secret.key,
+            value="••••••",
+        )
 
 
 class SecretUpdate(OrmBase):