feat: add secret store foundation

crates/crank-registry/src/migrations.rs

@@ -328,6 +328,42 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     .execute(pool)
     .await?;
 
+    query(
+        "create table if not exists secrets (
+            id text primary key,
+            workspace_id text not null references workspaces(id) on delete cascade,
+            name text not null,
+            kind text not null,
+            status text not null,
+            current_version integer not null,
+            last_used_at timestamptz null,
+            created_at timestamptz not null,
+            updated_at timestamptz not null
+        )",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create unique index if not exists secrets_workspace_name_idx on secrets(workspace_id, name)",
+    )
+    .execute(pool)
+    .await?;
+
+    query(
+        "create table if not exists secret_versions (
+            secret_id text not null references secrets(id) on delete cascade,
+            version integer not null,
+            ciphertext text not null,
+            key_version text not null,
+            created_at timestamptz not null,
+            created_by text null references users(id) on delete set null,
+            primary key (secret_id, version)
+        )",
+    )
+    .execute(pool)
+    .await?;
+
     query(
         "create table if not exists yaml_import_jobs (
             id text primary key,