feat(FN-009): implement config and secrets management with runtime injection

- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow

apps/api/app/services/spawn.py

@@ -38,6 +38,8 @@ class SpawnService:
         workspace_path: Path | None = None,
         config_path: Path | None = None,
         ssh_key_path: Path | None = None,
+        config_mounts: list[str] | None = None,
+        secret_env_vars: dict[str, str] | None = None,
     ) -> dict[str, Any]:
         service_name = f"tool-{instance_id[:8]}"
 
@@ -96,9 +98,15 @@ class SpawnService:
         if ssh_key_path and ssh_key_path.exists():
             volumes.append(f"{ssh_key_path}:/home/coder/.ssh:ro")
 
+        if config_mounts:
+            volumes.extend(config_mounts)
+
         if volumes:
             service["volumes"] = volumes
 
+        if secret_env_vars:
+            service["environment"].update(secret_env_vars)
+
         if manifest.health_check:
             hc = manifest.health_check
             healthcheck: dict[str, Any] = {
@@ -170,6 +178,8 @@ class SpawnService:
         workspace_path: Path | None = None,
         config_path: Path | None = None,
         ssh_key_path: Path | None = None,
+        config_mounts: list[str] | None = None,
+        secret_env_vars: dict[str, str] | None = None,
     ) -> dict[str, Any]:
         label_gen = TraefikLabelGenerator(domain=settings.root_domain)
 
@@ -203,6 +213,8 @@ class SpawnService:
             workspace_path=workspace_path,
             config_path=config_path,
             ssh_key_path=ssh_key_path,
+            config_mounts=config_mounts,
+            secret_env_vars=secret_env_vars,
         )
 
         compose_path = self._write_compose_file(instance_id, service)