feat: centralize workflow credentials

docs/plans/credential-consolidation.md

@@ -3,11 +3,14 @@
 This inventory contains names and provenance only. It intentionally contains no
 credential values or value hashes.
 
-## Proposed authority
+## Authority
 
 Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
 mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
-and an encrypt/decrypt round trip passed on 2026-09-06.
+and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
+this authority and an active-credentials-first migration. The directory is mode
+0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
+store.
 
 Keep the document hierarchical so operators can inspect and edit everything in
 one place while callers extract only their own scalar values or subtree. Do not
@@ -15,20 +18,19 @@ load the complete document into every repository environment. Public endpoints,
 queue names, bucket names, and other non-secret configuration remain with their
 normal owners.
 
-Candidate top-level groups:
+Top-level groups:
 
-- `company-login`
+- `company_login`
 - `databases`
 - `leafcloud`
 - `rabbitmq`
-- `service-accounts`
-- `third-party`
+- `applications`
 - `archive`
 
-Do not migrate or remove source values until the user approves this authority.
-After approval, migrate active credentials first, verify each consumer, then
-handle archived credentials and delete redundant plaintext only with explicit
-approval.
+Active credentials and ten archived credential sources have been migrated.
+Archive membership does not imply inactivity, so their source namespaces are
+preserved. Delete redundant plaintext only with explicit approval after each
+original consumer is verified.
 
 ## Active sources
 
@@ -38,12 +40,17 @@ approval.
   frontend source and is therefore client-visible, not a protectable secret.
 - `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
 - `~/rabbitmq-creds-test`: test RabbitMQ username and password.
+- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
 - `~/db-creds`: MySQL test/live and MongoDB test/live material.
 - `~/dev/work/yookr-api/http-client.private.env.json`: company email and
   password used for API logins.
 - `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
 
 All credential-bearing active files above are mode 0600 after the audit.
+They remain in place pending consumer-by-consumer removal approval. The dashboard
+backend's MySQL and MongoDB credentials do not match either named test/live pair,
+so they are preserved separately instead of being assigned an environment by
+assumption.
 
 ## Archived credential sources
 
@@ -54,9 +61,25 @@ All credential-bearing active files above are mode 0600 after the audit.
 - Legacy data science and soil-moisture tools: company login credentials.
 - `salemans`: CMI credentials.
 
-These files are now mode 0600. Preserve their provenance under `archive` until
-the user decides whether each credential is still valid; stale credentials
-should be revoked instead of retained indefinitely.
+These files are now mode 0600 and their selected credentials are preserved under
+`archive`. The user is still cleaning the filesystem, so stale status must be
+decided per source; stale credentials should be revoked instead of retained
+indefinitely.
+
+## Verified consumers
+
+- `yookr-workbench` decrypts once in memory and exports only its API login, four
+  database connections, Irristaud S3 credential, and test RabbitMQ credential.
+- Central test API login and the read-only RabbitMQ overview passed.
+- MySQL test/live `SELECT 1` and MongoDB test/live `ping` passed. The MongoDB
+  endpoints publish SRV rather than direct address records and therefore use
+  `mongodb+srv` URLs.
+- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
+  and listed its six root entries. No object content was downloaded and no
+  rclone configuration was persisted.
+
+Dadbod's four display names require activation of the pending Neovim
+configuration and explicit authorization of the changed workbench `.envrc`.
 
 ## Excluded from migration
 
@@ -76,8 +99,8 @@ credential is still active.
 
 ## Immediate findings
 
-- The discovered dashboard S3 credential can list eight Leafcloud containers but
-  cannot see `irristaud`; a credential from the `irristaud` project is required.
+- The dashboard S3 credential and the Irristaud project credential are distinct;
+  the latter is now centralized and its read-only pilot passed.
 - The generated Yookr OpenAPI document remains malformed, but direct requests use
   the reviewed local contract and work independently.
 - Management accepts an account-issued JWT only as the raw `Authorization` value,