feat(FN-009): implement config and secrets management with runtime injection

- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow

apps/web/src/router.tsx

@@ -13,6 +13,8 @@ import ToolSpawnPage from './pages/ToolSpawnPage'
 import ToolInstanceDetailPage from './pages/ToolInstanceDetailPage'
 import SettingsPage from './pages/SettingsPage'
 import RepositoriesPage from './pages/RepositoriesPage'
+import ConfigListPage from './pages/ConfigListPage'
+import SecretListPage from './pages/SecretListPage'
 
 export const router = createBrowserRouter([
   {
@@ -36,6 +38,8 @@ export const router = createBrowserRouter([
           { path: '/projects/:projectId/instances/:instanceId', element: <ToolInstanceDetailPage /> },
           { path: '/settings', element: <SettingsPage /> },
           { path: '/repositories', element: <RepositoriesPage /> },
+          { path: '/projects/:id/configs', element: <ConfigListPage /> },
+          { path: '/projects/:id/secrets', element: <SecretListPage /> },
         ],
       },
       { path: '/login', element: <LoginPage /> },