feat: secure organization provider credentials

hub/test/integration/helpers.ts

@@ -17,9 +17,16 @@ import type {
 } from "@ai-sdk/provider";
 import type { FeishuRuntime } from "../../src/feishu/client.js";
 import type { ModelFactory } from "../../src/agent/runner.js";
+import { LocalSecretEnvelope } from "../../src/security/secretEnvelope.js";
 
 export const TEST_DATABASE_URL = "postgresql://paradigm:paradigm@127.0.0.1:5432/cph_hub_test";
 export const DEFAULT_ORG_ID = "org_test_default";
+export const TEST_SECRET_KEY_ID = "test-active";
+export const TEST_SECRET_KEY = Buffer.alloc(32, "k");
+export const testSecretEnvelope = new LocalSecretEnvelope({
+  activeKeyId: TEST_SECRET_KEY_ID,
+  keys: new Map([[TEST_SECRET_KEY_ID, TEST_SECRET_KEY]]),
+});
 
 export const prisma = new PrismaClient({
   datasources: { db: { url: TEST_DATABASE_URL } },
@@ -29,6 +36,8 @@ export const prisma = new PrismaClient({
 export async function resetDb(): Promise<void> {
   const tables = [
     "FeishuEventReceipt",
+    "ProviderCredentialVersion",
+    "OrganizationProviderConnection",
     "AgentFileChange",
     "AgentMessage",
     "AuditEntry",