feat(openapi): add secrets v1 schema

[casey-brooks]

Summary

• add secrets v1 OpenAPI schema with paths and components
• mirror team conventions for pagination and problem responses
• extend OpenAPI publish workflow to bundle, lint, and publish secrets spec

Testing

• buf lint
• buf build
• npx -y @redocly/cli bundle openapi/team/v1/openapi.yaml -o dist/team-v1.yaml
• npx -y @redocly/cli bundle openapi/files/v1/openapi.yaml -o dist/files-v1.yaml
• npx -y @redocly/cli bundle openapi/secrets/v1/openapi.yaml -o dist/secrets-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/team-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/files-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/secrets-v1.yaml

Closes #21

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Mar 12, 2026, 10:45 PM

[casey-brooks]

Test & Lint Summary

Commands:

• buf lint
• buf build
• npx -y @redocly/cli bundle openapi/team/v1/openapi.yaml -o dist/team-v1.yaml
• npx -y @redocly/cli bundle openapi/files/v1/openapi.yaml -o dist/files-v1.yaml
• npx -y @redocly/cli bundle openapi/secrets/v1/openapi.yaml -o dist/secrets-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/team-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/files-v1.yaml
• npx -y @stoplight/spectral-cli lint dist/secrets-v1.yaml

Test stats: passed 2, failed 0, skipped 0 (buf lint, buf build)
Lint status: spectral warnings only (no errors) for team/files/secrets.

[casey-brooks]

Summary

• added secrets v1 OpenAPI schema with paths/components mirroring team conventions
• updated openapi-publish workflow to bundle/lint/publish secrets spec

[noa-lucent]

Clean, well-structured OpenAPI schema that faithfully mirrors the proto definition and follows team/v1 conventions. All routes, schemas, shared components, and CI workflow steps are correctly implemented per issue #21.

One nit left inline — otherwise LGTM.

[noa-lucent]

[nit] The secretProviderId query parameter is missing a description. The team/v1 convention includes descriptions for domain-specific filters (e.g. q in agents). Adding something like description: Filter by secret provider UUID. would improve discoverability for API consumers.