feat: add per-widget secret storage for release provider authentication

Adds encrypted token storage per release widget so users can authenticate
with GitHub, GitLab, Docker Hub, etc. without needing full integration setup.

- New `widget_secret` table (all 3 DB drivers) keyed by (itemId, kind)
- tRPC router with setSecret/deleteSecret/getConfiguredKinds (board modify access required)
- Releases router injects decrypted tokens into provider requests (board view access required)
- Tokens only used for repos matching widget's stored configuration (prevents proxy abuse)
- Provider auth: GitHub (Octokit auth), GitLab (PRIVATE-TOKEN), Docker Hub (Bearer),
  GHCR (registry token), npm (Bearer), Codeberg (token header)
- UI: "Provider Tokens" section in widget editor with PasswordInput per provider

packages/api/src/router/widgets/widget-secrets.ts

@@ -0,0 +1,63 @@
+import { TRPCError } from "@trpc/server";
+import { z } from "zod/v4";
+
+import { encryptSecret } from "@homarr/common/server";
+import { and, eq } from "@homarr/db";
+import { boards, items, widgetSecrets } from "@homarr/db/schema";
+import { releaseProviderKinds } from "@homarr/definitions";
+
+import { createTRPCRouter, protectedProcedure } from "../../trpc";
+import { throwIfActionForbiddenAsync } from "../board/board-access";
+
+const secretKindSchema = z.enum(releaseProviderKinds);
+
+const resolveItemWithBoardAccess = async (
+  ctx: { db: any; session: any },
+  itemId: string,
+) => {
+  const item = await ctx.db.query.items.findFirst({ where: eq(items.id, itemId) });
+  if (!item || item.kind !== "releases") throw new TRPCError({ code: "NOT_FOUND" });
+  await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "modify");
+  return item;
+};
+
+export const widgetSecretsRouter = createTRPCRouter({
+  setSecret: protectedProcedure
+    .input(z.object({ itemId: z.string(), kind: secretKindSchema, value: z.string().min(1).max(4096) }))
+    .mutation(async ({ ctx, input }) => {
+      await resolveItemWithBoardAccess(ctx, input.itemId);
+
+      await ctx.db
+        .delete(widgetSecrets)
+        .where(and(eq(widgetSecrets.itemId, input.itemId), eq(widgetSecrets.kind, input.kind)));
+
+      await ctx.db.insert(widgetSecrets).values({
+        itemId: input.itemId,
+        kind: input.kind,
+        value: encryptSecret(input.value),
+        updatedAt: new Date(),
+      });
+    }),
+
+  deleteSecret: protectedProcedure
+    .input(z.object({ itemId: z.string(), kind: secretKindSchema }))
+    .mutation(async ({ ctx, input }) => {
+      await resolveItemWithBoardAccess(ctx, input.itemId);
+
+      await ctx.db
+        .delete(widgetSecrets)
+        .where(and(eq(widgetSecrets.itemId, input.itemId), eq(widgetSecrets.kind, input.kind)));
+    }),
+
+  getConfiguredKinds: protectedProcedure
+    .input(z.object({ itemId: z.string() }))
+    .query(async ({ ctx, input }) => {
+      await resolveItemWithBoardAccess(ctx, input.itemId);
+
+      const secrets = await ctx.db.query.widgetSecrets.findMany({
+        where: eq(widgetSecrets.itemId, input.itemId),
+        columns: { kind: true },
+      });
+      return secrets.map((s: { kind: string }) => s.kind);
+    }),
+});