feat: resolve auth profiles through secret ids

crates/crank-core/src/operation.rs

@@ -266,7 +266,7 @@ mod tests {
     use serde_json::json;
 
     use crate::{
-        auth::{AuthConfig, AuthProfile, BearerAuthConfig, SecretRef},
+        auth::{AuthConfig, AuthProfile, BearerAuthConfig},
         ids::{AuthProfileId, OperationId, SampleId},
         operation::{
             ConfigExport, ExecutionConfig, GraphqlTarget, Operation, OperationStatus,
@@ -430,7 +430,7 @@ mod tests {
     }
 
     #[test]
-    fn auth_profile_serializes_secret_refs_without_secret_values() {
+    fn auth_profile_serializes_secret_ids_without_secret_values() {
         let profile = AuthProfile {
             id: AuthProfileId::new("auth_01"),
             workspace_id: crate::ids::WorkspaceId::new("ws_01"),
@@ -438,7 +438,7 @@ mod tests {
             kind: AuthKind::Bearer,
             config: AuthConfig::Bearer(BearerAuthConfig {
                 header_name: "Authorization".to_owned(),
-                secret_ref: SecretRef::new("secret://auth/crm-prod-token"),
+                secret_id: crate::ids::SecretId::new("secret_crm_prod_token"),
             }),
             created_at: "2026-03-25T08:00:00Z".to_owned(),
             updated_at: "2026-03-25T08:00:00Z".to_owned(),
@@ -448,8 +448,8 @@ mod tests {
 
         assert_eq!(value["kind"], "bearer");
         assert_eq!(
-            value["config"]["bearer"]["secret_ref"],
-            "secret://auth/crm-prod-token"
+            value["config"]["bearer"]["secret_id"],
+            "secret_crm_prod_token"
         );
     }