feat(secrets): teach secrets.subscribe() and link docs in Secrets config guidance

[dawsontoth]

Enhances the inline "How to read it in your component" guidance on the cluster Secrets config page (the add/edit dialogs) in two ways.

1. Practical secrets.subscribe() usage (harper#1787)

The scoped-tier example now demonstrates the live-change API: read the value immediately, then subscribe in a fire-and-forget background task so module load isn't blocked — with a guard so the first (current-value) yield doesn't trigger a redundant rebuild:

import { secrets } from 'harper';

// Use the current value right away — read at your module's top level.
let value = secrets.STRIPE_KEY;

// Then react to rotations without blocking startup. Subscribing in a background
// task lets module load finish, so the rest of your app keeps initializing.
(async () => {
	for await (const next of secrets.subscribe('STRIPE_KEY')) {
		if (next === value) continue; // the first yield is the current value you already have
		value = next; // rotated — rebuild anything bound to the secret (e.g. an API client) here
	}
})();

The global / process.env tier example is unchanged — per harper#1787's tier semantics, subscribe there is reload-only (not live), so a hot-swap example would mislead. Name-aware bracket notation is preserved (secrets['deploy.my-app']).

2. Outward documentation links

• A contextual "Learn more about secrets in the Harper docs" link right under the code example (covers the config page and any delivery-enabled surface).
• A page-level "Secrets Docs" link in the Secrets config toolbar, matching the existing SSH-keys / certificates convention.

Both point to https://docs.harperdb.io/reference/v5/security/secrets (the current canonical docs structure). Plain <a target="_blank" rel="noreferrer"> — the repo's dominant external-link pattern — rather than TanStack Link, so the isolated dialog test stays router-free.

Docs

The docs page that backs the subscribe() example is HarperFast/documentation#584 (stacked on the secrets-store docs PR #581). It predated harper#1787, so #584 adds the secrets.subscribe() section, the live-accessor note, and the per-tier change table.

Verification

• accessExample.test.ts and SecretsManager.delivery.test.tsx updated; the delivery test renders the actual dialog DOM and asserts the subscribe line, the change-guard, and the doc-link href. 14/14 secrets tests pass; tsc --noEmit, dprint check, and oxlint all clean.

Note: committed unsigned — this environment has no TTY for gpg pinentry, so signing failed. Happy to amend with a signed commit if the branch protection needs it.

🤖 Generated with Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	50.92%	5421 / 10645
🔵	Statements	51.49%	5805 / 11272
🔵	Functions	43.11%	1327 / 3078
🔵	Branches	44.42%	3660 / 8239

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/instance/config/secrets/index.tsx	0%	0%	0%	0%	27-183
src/features/instance/secrets/SecretDeliveryPicker.tsx	100%	100%	100%	100%
src/features/instance/secrets/SecretsManager.tsx	96.55%	91.42%	94.11%	100%	111
src/features/instance/secrets/accessExample.ts	100%	100%	100%	100%

Generated in workflow #1537 for commit 75207c2 by the Vitest Coverage Report Action

[gemini-code-assist]

Code Review

This pull request updates the scoped secrets access example to read the live accessor and subscribe to secret rotations asynchronously using secrets.subscribe(), replacing the previous static destructuring approach. It also adds links to the Harper secrets documentation in the UI and updates the corresponding tests. The reviewer suggested wrapping the asynchronous subscription loop in a try-catch block to prevent unhandled promise rejections from crashing the application, as this code is intended to be copied and pasted by users.