feat(deployment): manage persistent App secrets across redeploys

[Yevanchen]

Area

App Deployment / Secrets

Problem

A deployed App can need a server-side credential for a third-party or Mosoo Public API, but Mosoo Deployment currently has no App-secret surface. The manifest can bind Agents as generated plain-text capability URLs, while secret values must be added afterward with provider-specific tooling.

This breaks the Deployment abstraction and makes a working App fragile across redeploys.

Reproduction

The public Yevanchen/mosoo-codex-pet App uses Mosoo attachment upload, asynchronous Threads, and artifact download. These Public API routes require an owner PAT kept only in the Worker.

1. Deploy through mosoo console apps deploy-app.
2. The Deployment succeeds and binds MOSOO_AGENT_CODEX_PET_URL.
3. POST /api/pets returns The Mosoo backend is not configured because MOSOO_API_TOKEN is absent.
4. wrangler secret put MOSOO_API_TOKEN --name <managed-worker> fixes the live App; a safe multipart smoke then reaches Mosoo and returns the expected file is required validation.

Current Worker upload metadata is built only from Mosoo-resolved plain-text bindings. Cloudflare Worker versions capture bindings as part of version state, so an out-of-band secret is not a durable Mosoo Deployment contract and may be dropped by a later managed redeploy.

User story

As an App Owner, I want to declare required secret names and set their values in Mosoo so deployments fail fast when a secret is missing and preserve configured secrets across every redeploy without exposing values to source code, build logs, Runs, or API responses.

Acceptance criteria

• An App Owner can create/update/revoke an App-scoped secret through Console and CLI/API.
• Secret values are write-only; list/read surfaces return names and metadata, never values.
• .mosoo.toml can declare required secret names without containing values.
• Deployment validates required secrets before external submission and returns a stable actionable error when one is missing.
• Worker uploads bind configured values as Cloudflare secret bindings and preserve them across new versions/redeploys.
• Deleting the App deployment removes/revokes its managed Worker secrets according to a documented lifecycle.
• Build Sandboxes, generated Wrangler config, logs, Run payloads, GraphQL, and CLI output never contain secret values.
• Existing Agent bindings and Apps with no declared secrets remain backward compatible.
• A regression test covers first deploy, secret rotation, redeploy, and deletion.

Out of scope

• A general-purpose vault UI
• Client-visible environment variables
• Cross-App shared secrets
• Automatically minting owner PATs without explicit consent

Workaround

Run wrangler secret put against the managed Worker after each Mosoo deployment. This is functional today but should not be the product contract.

Checklist

• I searched existing open and closed issues before opening this request.
• I reproduced the gap against a successful Mosoo Deployment.
• No secret value is included in this issue.