Passkey confirmation for vault changes, and use only for databases

Changing where a secret may go, or showing it, now needs your passkey, checked by the key service itself. Postgres and MySQL join the targets a use-only secret can log in to.

User impact: Not reviewed

Three changes to the vault, all enforced by the key service rather than the app.

Your passkey confirms what matters. Adding a host to "allowed for", switching an entry back to visible and showing a value in the interface now need a fresh passkey confirmation. The key service checks it itself. It is tied to that one action on that one entry, valid for 60 seconds and usable once, so a taken-over app cannot forge it. Without a passkey the page blocks the action and offers to set one up.

The browser signs the exact change, the app passes it on, and the key service verifies it before anything is applied or revealed.

No plaintext for platform tools. Git services, developer services and the domain registrar no longer fetch values. They borrow a short-lived placeholder and send requests through the inserting tunnel, so the app never holds the value.

Databases. "Use only" now works for Postgres (port 5432) and MySQL or MariaDB (port 3306). The AI logs in with the placeholder as the password, and the key service completes the login with the real one, over TLS with a checked certificate when the database offers TLS. A wrong host, another account's placeholder or the real password typed by hand is refused. SSH stays at visible or locked, because a safe version needs a full SSH server and client inside the key service.

Limits. A confirmation you give is valid, and the app serves the interface, so a taken-over app could still talk you into one. After a database login the data stream is not scanned for the value. "Unreadable even if the app is broken into" now holds fully for theft and for any access without you, and partly against an app that persuades you.