feat(FN-009): implement config and secrets management with runtime injection

- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow

docs/architecture.md

@@ -1171,3 +1171,44 @@ Any implementation task must:
 7. **High availability:** No replicas or load balancing in MVP.
 8. **Backup strategy:** Out of MVP scope; rely on host-level volume backups.
 9. **Rate limiting:** Not in MVP; add at Traefik or API gateway layer later.
+
+## 19. Config & Secrets System
+
+### 19.1 Design
+
+The config and secrets system provides scoped, runtime-injected configuration for tool containers.
+
+**Config:**
+- Plaintext JSON values
+- Mounted as read-only files at `/app/config/<key>.json`
+- Scope hierarchy: global → user → project → instance (closest wins)
+
+**Secrets:**
+- Encrypted with Fernet at rest
+- Injected as environment variables with uppercase keys
+- Never exposed decrypted to the frontend (masked as `••••••`)
+- Scope hierarchy: global → user → project → instance (closest wins)
+
+### 19.2 Runtime Injection
+
+When a tool instance is spawned:
+
+1. **Config Resolution:** Collect configs from all applicable scopes, with closer scopes overriding broader ones
+2. **Secret Resolution:** Decrypt secrets from all applicable scopes, with closer scopes overriding broader ones
+3. **Config File Generation:** Write JSON files to `/tmp/headquarter-configs/{instance_id}/`
+4. **Volume Mounting:** Mount config files as read-only volumes with `0400` permissions
+5. **Env Var Injection:** Add decrypted secrets to the container's environment variables
+6. **Validation:** Fail spawn if required secrets are missing, with clear error messages
+
+### 19.3 Frontend
+
+- `/projects/{id}/configs` — Config management with JSON formatting
+- `/projects/{id}/secrets` — Secret management with masked values
+- Both support create, read, update, delete operations with scope selection
+
+### 19.4 Security
+
+- Config files have restrictive permissions (0400)
+- Secret values are never sent to the frontend
+- Decryption only happens during runtime injection in the backend
+- Missing required secrets prevent container spawn