fix(secrets): auto-refresh global_secrets on workspace restart (#15)

[HongmingWang-Rabbit]

Resolves #15.

Problem

Provisioner reads CLAUDE_CODE_OAUTH_TOKEN (and all env vars derived from
global_secrets) once at ContainerCreate. When the Claude Max OAuth token
rotates, existing workspaces keep the stale token and the Claude CLI dies
with 401 Invalid authentication credentials. Remediation was a manual
POST /admin/secrets + per-workspace restart loop (incident 2026-04-13:
~15 min recovery, 12 workspaces).

Fix

Restart-time re-read of secrets was already correct — provisionWorkspaceOpts
re-queries global_secrets + workspace_secrets on every call, and
provisioner.Start() always force-removes + recreates the container. The
missing piece was the trigger.

SetGlobal / DeleteGlobal now enqueue RestartByID for every non-paused,
non-removed, non-external workspace that does NOT shadow the key with a
workspace-level override. Mirrors the behaviour of workspace-scoped
Set / Delete (which already auto-restart).

Effectively implements the "bonus" refresh-all step from the issue, without
a new endpoint: updating the global secret via the existing endpoint
propagates automatically.

Files

• platform/internal/handlers/secrets.go — restartAllAffectedByGlobalKey helper + wiring in SetGlobal / DeleteGlobal
• platform/internal/handlers/secrets_test.go — two sqlmock tests covering set and delete paths, verifying NOT IN (workspace_secrets WHERE key=...) filter

Test plan

• go build ./... && go vet ./... clean
• go test -race ./... pass (platform)
• New tests TestSetGlobal_AutoRestartsAffectedWorkspaces and TestDeleteGlobal_AutoRestartsAffectedWorkspaces assert restart callback fires for affected workspaces
• E2E verification pending live platform: set global secret → confirm existing workspaces restart and pick up new value

Generated with Claude Code

[HongmingWang-Rabbit]

noteworthy: secrets-handling — merging after 7-gate verification.

7 gates clean. Code-review: 0 🔴 / 1 🟡 / 4 🔵.

The 🟡 — unbounded goroutine fan-out on global-secret rotation — is a real scaling concern (1000 workspaces × 1 fan = correlated restart storm) but doesn't trigger at current scale (<50 workspaces). Tracked as a follow-up rather than blocker since:

1. The base-case fix (rotated secrets actually propagate) is the user-facing win
2. Adding a worker-pool gate would expand scope beyond the issue
3. Throttling is a 1-line fix when needed

Cross-vendor review attempted but tooling unavailable in cron context.

Other 🔵 nits worth a follow-up cleanup PR: explicit override-shadow SQL assertion, ctx timeout on the affected-workspaces query, log warning on nil restartFunc.