feat: resolve upstream auth at runtime

TASKS.md

@@ -2,19 +2,19 @@
 
 ## Current
 
-### `feat/auth-profile-secret-resolution`
+### `feat/runtime-upstream-auth`
 
 Status: completed
 
 DoD:
-- `AuthConfig` references real `SecretId` values instead of string placeholders
-- auth profile create flow validates all referenced secrets inside the workspace
-- secret delete is rejected while an auth profile still references the secret
-- tests cover missing-secret validation and reference-protected secret deletion
+- runtime resolves `auth_profile_ref` into decrypted secret-backed auth before upstream execution
+- `admin-api` test-runs and `mcp-server` tool calls use the same auth-aware runtime path
+- secret usage updates `last_used_at` when auth-backed execution succeeds at resolution time
+- tests and clippy pass for `crank-runtime`, `crank-registry`, `admin-api`, and `mcp-server`
 
 ## Next
 
-- `feat/runtime-upstream-auth`
+- `feat/secrets-ui`
 
 ## Backlog