feat(keystore,api,ui,docker): encrypted secrets store with a write-only admin page and a secret run helper for the model

Dockerfile

@@ -74,7 +74,7 @@ ENV BEAVER_CLAUDE_CLI=/usr/local/bin/claude-cli
 # `acl` lets the entrypoint grant it write access to the vault sub-mounts
 # without chowning files that Obsidian Sync keeps rewriting as root.
 RUN apt-get update \
- && apt-get install -y --no-install-recommends acl \
+ && apt-get install -y --no-install-recommends acl sudo \
  && rm -rf /var/lib/apt/lists/* \
  && useradd --system --uid 1001 --create-home --shell /usr/sbin/nologin beaver-runner
 
@@ -83,6 +83,10 @@ ENV PATH=/app/.venv/bin:$PATH
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=builder /app /app
 COPY --from=ui /ui/build /app/ui/build
+COPY --chmod=0755 docker/secret /usr/local/bin/secret
+COPY --chmod=0755 docker/beaver-secret /usr/local/libexec/beaver-secret
+COPY --chmod=0440 docker/sudoers /etc/sudoers.d/beaver-secret
+RUN visudo -cf /etc/sudoers.d/beaver-secret
 WORKDIR /app
 
 ENTRYPOINT ["python", "-m"]