feat(vault): Added 1Password as Secrets provider

[bjerringgaard]

What is this PR about?

Added 1Password as an option for the vault-providers.
Making use of 1password's newer "Environments" feature.
Relying on 1Password's Service Account Authentication

Checklist

Before submitting this PR, please make sure that:

• [✔︎ ] You created a dedicated branch based on the canary branch.
• [✔︎ ] You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• [✔︎] You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #1777
closes #1192

Greptile Summary

The PR adds 1Password Environments as an organization-level vault provider using service-account authentication.

• Adds the provider schema, database enum migration, credential masking, registry entry, and SDK-backed client.
• Adds dashboard configuration fields, labels, and provider icon.
• Resolves environment variables through the existing vault-reference deployment boundary.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking request-lifecycle concern around unbounded 1Password SDK calls.

The provider is integrated across schema, migration, masking, UI, and vault dispatch, but its external API path does not explicitly preserve the bounded-request behavior used by the other HTTP-backed vault clients.

Files Needing Attention: packages/server/src/utils/vault/onepassword.ts

_{Reviews (1): Last reviewed commit: "feat(vault): Added 1Password as Secret p..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Knowledge Base — DNS and Vault Providers

[greptile-apps]

Unbounded 1Password API request

The 1Password client awaits getVariables without the shared 15-second request bound used by the HTTP-based vault clients. If the 1Password API is slow or unresponsive, vault resolution, connection tests, and secret-name requests remain stalled beyond the expected timeout.

Knowledge Base Used: DNS and Vault Providers