feat: add secret store foundation

TASKS.md

@@ -2,18 +2,19 @@
 
 ## Current
 
-### `feat/secrets-auth-plan`
+### `feat/secret-store-foundation`
 
 Status: completed
 
 DoD:
-- Docs describe the target secret store and auth profile model
-- Backend, runtime, and UI gaps are captured as vertical slices
-- TASKS and implementation plan reflect the new sequence
+- Workspace-scoped secret store is persisted in PostgreSQL
+- Secret values are encrypted with `CRANK_MASTER_KEY`
+- Admin API exposes create/list/get/rotate/delete secret endpoints
+- Integration tests cover secret CRUD and rotation
 
 ## Next
 
-- `feat/secret-store-foundation`
+- `feat/auth-profile-secret-resolution`
 
 ## Backlog