Add a secrets CLI for typed application configuration #284

Description

Provide an explicit operator workflow for secret-backed typed app configuration. Runtime secret metadata and resolution exist, including nested/array paths and optional containers, but current CLI commands has no secrets command group. config push must continue publishing config blobs without implicitly mutating secret stores.

Motivating fields include publisher proxy secrets, EC passphrases/keys, handler passwords and partner API tokens in Trusted Server. The original AppConfigMeta::SECRET_FIELDS reference is historical; current metadata is exposed by AppConfigMeta::secret_fields().

Steps to reproduce

Inspection steps (no provider mutation executed):

1. Inspect the CLI command enum and typed config secret metadata.
2. Look for secrets set, secrets check and secrets delete.
3. Compare the unmerged helpers in PR #444 with the complete operator command requirements below.

Expected behavior

Operators manage actual provider secret values explicitly, with hidden input, CI-friendly checks and deliberate deletion, while typed config carries secret references.

Impact

Downstream applications need custom scripts/provider calls and may otherwise put plaintext secret material into application config or config-store blobs.

Proposed fix

Add edgezero secrets set <key>, check <key> and delete <key>, reusable by generated typed app CLIs. Resolve the selected adapter and default [stores.secrets] store, support --store and --adapter overrides, and abstract provider capabilities. Reuse the reviewed Fastly operations from PR #444 where appropriate.

set prompts without echo by default; confirmation/repeat-entry can be used for manual input. check returns zero for verified availability and nonzero for missing/inaccessible/unverifiable cases, without exposing values. delete confirms unless --yes. Preserve local operation support and dry-run behavior where supported. Explicit noninteractive input (--value-stdin, --from-env, --from-file) can follow the initial interactive surface.

Future typed planning/check-all commands remain follow-up scope. A reusable descriptor design may later describe nested and repeated config paths, requiredness, store/key, inline-authoring policy and optional random generation. Do not make that expanded descriptor system a prerequisite for the initial key-based CRUD/check interface.

Done when

• Expose the secrets command group in EdgeZero and reusable typed-CLI dispatch.
• set <key> accepts hidden interactive input and writes to the resolved provider store.
• check <key> has documented CI-friendly status/exit semantics, including write-only or unsupported providers.
• delete <key> requires confirmation unless --yes.
• Resolve manifest defaults and support --store <id> / --adapter <name> overrides.
• Document and implement supported local/dry-run behavior without accidental cloud writes.
• Keep config push free of implicit secret-store writes.
• Document composition with current typed secret metadata, nested/array references and provider limitations.
• Cover missing stores, provider failures, redaction, confirmation and successful operations with credential-free fixtures.

Related

trusted-server#684; trusted-server#799; PR #344 provides adjacent metadata/mapping work; PR #444 provides partial Fastly host primitives, not the complete CLI.