feat: add workspace secrets ui

TASKS.md

@@ -2,19 +2,20 @@
 
 ## Current
 
-### `feat/runtime-upstream-auth`
+### `feat/secrets-ui`
 
 Status: completed
 
 DoD:
-- runtime resolves `auth_profile_ref` into decrypted secret-backed auth before upstream execution
-- `admin-api` test-runs and `mcp-server` tool calls use the same auth-aware runtime path
-- secret usage updates `last_used_at` when auth-backed execution succeeds at resolution time
-- tests and clippy pass for `crank-runtime`, `crank-registry`, `admin-api`, and `mcp-server`
+- separate `Secrets` page exists next to `API Keys`
+- UI supports list/create/rotate/delete for workspace secrets on live backend endpoints
+- UI shows read-only auth profile usage references for each secret
+- no UI flow pretends to reveal plaintext after create/rotate when backend does not return it
+- node checks, UI docker build, and workspace check pass
 
 ## Next
 
-- `feat/secrets-ui`
+- `feat/wizard-auth-selector`
 
 ## Backlog