secret store holds foreign secrets, and notify reads from it

putSecret/getSecret, `bun run secret:set`, and notify taking its credentials
from the store with env as the fallback. this was described two messages ago
as a later thing; it is about fifteen lines and it was blocking the honest
answer to "where does the .p8 go", so it is done.

getKey was the wrong door for anything supplied from outside — it MINTS a
random 32-byte value when the purpose is absent, which for a foreign
credential means silently authenticating to apple with a fake. getSecret
returns null instead, which is what lets the env fallback work.

putSecret retires the previous row rather than deleting it: a mistyped paste
over a working key should be recoverable, and retiredKeys already exists for
that shape. one transaction, because the partial unique index means the retire
has to land before the insert.

the CLI reads stdin and has deliberately no --value flag: a secret in argv is
in shell history, in ps output, and in any audit log that records command
lines. offering the flag would make the convenient path the leaky one. it
prints a length and the last four characters, never the value.

also `bun run notify:test`, which fires officer/core:test at a registered
device. the sidecar's port is ephemeral, so it now writes its address to
data/notify-server.url on boot and removes it on clean shutdown; the CLI
treats an unreachable address as "not running" rather than trusting the file,
because a crash leaves one behind.

the script says what actually happened, because the day-waster here is that a
send with nothing configured returns success and delivers nothing — it refuses
up front when channels is empty, and calls out sent:0/failed:0 as "no device
registered" rather than letting it read as success.

verified end to end with a p-256 key generated locally and then deleted from
the store: zero APNS vars in .env, sidecar reported channels: apns, and the
send reached the channel. store is back to jwt and offscale only.

src/databases/officer_db/src/secret-store.ts

@@ -144,6 +144,49 @@ export function getKey(purpose: string): string {
   }
 }
 
+/**
+ * Read a secret WITHOUT creating one. Null when the purpose has never been set.
+ *
+ * `getKey` is the wrong door for anything supplied from outside: it mints a random 32-byte value when the
+ * purpose is absent, which for a foreign credential means silently substituting a key that authenticates
+ * to nothing. A caller that has an env fallback needs to be told "not here", not handed a fake.
+ */
+export function getSecret(purpose: string): string | null {
+  return readActive(purpose);
+}
+
+/**
+ * Store a secret the platform did NOT generate — an APNs `.p8`, an FCM service account, a webhook URL.
+ *
+ * Everything else in this store is minted here, which is why `getKey` creates on demand. These arrive
+ * from outside and can never be regenerated, so they are written rather than derived, and replacing one
+ * RETIRES the old row instead of deleting it: a mistyped paste that overwrites a working key should be
+ * recoverable, and `retiredKeys` already exists for exactly this shape.
+ *
+ * Returns the previous value, or null if there was none — so a caller can tell "set" from "replaced"
+ * without reading first and racing itself.
+ */
+export function putSecret(purpose: string, value: string): string | null {
+  if (!value) throw new Error('secret-store: refusing to store an empty secret');
+
+  const handle = open();
+  const now = Math.floor(Date.now() / 1000);
+
+  // One transaction, because the partial unique index means the retire MUST land before the insert —
+  // two active rows for one purpose is the state it exists to prevent.
+  const previous = handle.transaction((): string | null => {
+    const existing = readActive(purpose);
+    if (existing === value) return existing; // idempotent: re-running a setup script is not a rotation
+    if (existing !== null) {
+      handle.query('UPDATE keys SET retired_at = ? WHERE purpose = ? AND retired_at IS NULL').run(now, purpose);
+    }
+    handle.query('INSERT INTO keys (purpose, key, created_at) VALUES (?, ?, ?)').run(purpose, value, now);
+    return existing;
+  })();
+
+  return previous;
+}
+
 /** Whether a purpose has an active key, without creating one. */
 export function hasKey(purpose: string): boolean {
   return readActive(purpose) !== null;