chore(openspec): archive completed changes

- Archive config-secrets (FN-009) - 31 tasks complete
- Archive runfusion-poc (FN-008) - 25 tasks complete
- Archive deployment-config (FN-006) - 27 tasks complete
- All changes moved to openspec/changes/archive/

openspec/changes/archive/2026-05-14-config-secrets/specs/secret-management/spec.md

@@ -0,0 +1,37 @@
+## ADDED Requirements
+
+### Requirement: User can create secrets
+The system SHALL allow users to store encrypted secret values.
+
+#### Scenario: Create secret
+- **WHEN** the user navigates to project secrets
+- **AND** clicks "Add Secret"
+- **THEN** a form appears with key and value fields
+- **AND** the value is encrypted with Fernet before storage
+- **AND** the user sees a masked value (e.g., ••••••) after creation
+
+#### Scenario: Secret scope
+- **WHEN** the user creates a secret
+- **THEN** the scope can be user, project, or instance
+- **AND** the secret is only visible within that scope hierarchy
+
+### Requirement: Secrets are never exposed decrypted
+The system SHALL prevent decrypted secret values from being sent to the frontend.
+
+#### Scenario: Secret list display
+- **WHEN** the user views the secrets list
+- **THEN** only secret keys and scopes are visible
+- **AND** values are always masked
+
+#### Scenario: Secret update
+- **WHEN** the user updates a secret
+- **THEN** only the new value is sent to the backend
+- **AND** the old value is replaced (not displayed)
+
+### Requirement: User can delete secrets
+The system SHALL allow deletion of secret values.
+
+#### Scenario: Delete secret
+- **WHEN** the user deletes a secret
+- **THEN** the encrypted value is permanently removed
+- **AND** the secret is no longer injected into containers