fix(widget-secrets): add missing widget_secret migration and add error notifications (#6192)

* fix(widget-secrets): add missing widget_secret migration and add error notifications

The widget_secret table was defined in all three Drizzle schema files but
no SQL migration was ever generated to create it, causing setSecret to
fail with 'no such table: widget_secret' in production (drizzle-kit push
in development hid the problem).

- Add migration SQL for sqlite (0040), mysql (0042), postgresql (0008)
- Update journal entries for all three dialects
- Add onError handlers to setSecret/deleteSecret mutations so errors
  are shown as red notifications instead of silently swallowed

Fixes #6186

* fix(widget-secrets): add missing drizzle snapshots for merge-url and widget_secret migrations

The merge_custom_widget_url migration (0039/0041/0007) was committed
without a corresponding snapshot, breaking drizzle-kit generate for
all future migrations. This adds:
- 0039/0041/0007 snapshots reflecting the merge-url changes
  (base_url+endpoint -> url, add enabled column)
- 0040/0042/0008 snapshots reflecting the widget_secret table

All snapshot chains now match journal entries (41/43/9 entries each).

packages/db/migrations/mysql/0042_add_widget_secret.sql

@@ -0,0 +1,9 @@
+CREATE TABLE `widget_secret` (
+	`item_id` varchar(64) NOT NULL,
+	`kind` varchar(64) NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` timestamp NOT NULL,
+	CONSTRAINT `widget_secret_item_id_kind_pk` PRIMARY KEY(`item_id`,`kind`)
+);
+--> statement-breakpoint
+ALTER TABLE `widget_secret` ADD CONSTRAINT `widget_secret_item_id_item_id_fk` FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON DELETE cascade ON UPDATE no action;

packages/db/migrations/mysql/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1780764500000,
       "tag": "0041_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "5",
+      "when": 1783176100870,
+      "tag": "0042_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/postgresql/0008_add_widget_secret.sql

@@ -0,0 +1,9 @@
+CREATE TABLE "widget_secret" (
+	"item_id" varchar(64) NOT NULL,
+	"kind" varchar(64) NOT NULL,
+	"value" text NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	CONSTRAINT "widget_secret_item_id_kind_pk" PRIMARY KEY("item_id","kind")
+);
+--> statement-breakpoint
+ALTER TABLE "widget_secret" ADD CONSTRAINT "widget_secret_item_id_item_id_fk" FOREIGN KEY ("item_id") REFERENCES "public"."item"("id") ON DELETE cascade ON UPDATE no action;

packages/db/migrations/postgresql/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1780764500000,
       "tag": "0007_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1783176100870,
+      "tag": "0008_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/sqlite/0040_add_widget_secret.sql

@@ -0,0 +1,8 @@
+CREATE TABLE `widget_secret` (
+	`item_id` text NOT NULL,
+	`kind` text NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` integer NOT NULL,
+	PRIMARY KEY(`item_id`, `kind`),
+	FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON UPDATE no action ON DELETE cascade
+);

packages/db/migrations/sqlite/meta/_journal.json

@@ -281,6 +281,13 @@
       "when": 1780764500000,
       "tag": "0039_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "6",
+      "when": 1783176100870,
+      "tag": "0040_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/widgets/src/_inputs/widget-multiReleasesRepositories-input.tsx

@@ -50,6 +50,7 @@ import {
 } from "@homarr/definitions";
 import { findBestIconMatch, IconPicker } from "@homarr/forms-collection";
 import { createModal, useModalAction } from "@homarr/modals";
+import { showErrorNotification } from "@homarr/notifications";
 import { useScopedI18n } from "@homarr/translation/client";
 import { MaskedImage } from "@homarr/ui";
 
@@ -269,8 +270,24 @@ const providersWithAuth: ReleaseProviderKind[] = [
 const ProviderTokensSection = ({ itemId, repositories }: { itemId: string; repositories: ReleasesRepository[] }) => {
   const tRepository = useScopedI18n("widget.releases.option.repositories");
   const { data: configuredKinds = [], refetch } = clientApi.widget.secrets.getConfiguredKinds.useQuery({ itemId });
-  const setSecret = clientApi.widget.secrets.setSecret.useMutation({ onSuccess: () => refetch() });
-  const deleteSecret = clientApi.widget.secrets.deleteSecret.useMutation({ onSuccess: () => refetch() });
+  const setSecret = clientApi.widget.secrets.setSecret.useMutation({
+    onSuccess: () => refetch(),
+    onError: (error) => {
+      showErrorNotification({
+        title: "Failed to save token",
+        message: error.message,
+      });
+    },
+  });
+  const deleteSecret = clientApi.widget.secrets.deleteSecret.useMutation({
+    onSuccess: () => refetch(),
+    onError: (error) => {
+      showErrorNotification({
+        title: "Failed to delete token",
+        message: error.message,
+      });
+    },
+  });
 
   const authProviders = useMemo(() => {
     const usedProviders = repositories.map((r) => r.provider).filter((p): p is ReleaseProviderKind => p !== undefined);