feat(orb): add a secret_type discriminator to the enrollment broker

[JSONbored]

Summary

• First slice of Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174 (generalize src/orb/broker.ts into a multi-secret-type broker, shared by ORB + AMS hosted per Design: shared hosting control-plane for ORB + AMS SaaS (provisioning, secrets, billing, health) #7173): adds the secret_type schema/safety groundwork only. orb_enrollments gains a secret_type column (NOT NULL DEFAULT 'github_token'), issueOrbEnrollment accepts an optional secretType param defaulting to the only mintable type today, and brokerOrbToken refuses to GitHub-mint a row recorded under a different type (unsupported_secret_type, mapped to HTTP 500) instead of silently assuming one.
• Deliberately scoped narrow: no AI-provider-key mint strategy is implemented here — that's real follow-up work once there's an actual caller for it (Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's provisioning core). This PR only makes the schema and the broker's own safety checks ready for it.
• Every existing GitHub-token caller (src/orb/oauth.ts's self-enrollment, the internal enrollment endpoint) is unaffected — the new parameter is optional and defaults to today's only behavior.

Closes #7174

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Validation

• git diff --check
• npm run db:migrations:check — 168 migrations OK, contiguous through 0164.
• npm run db:schema-drift:check — orb_enrollments already allowlisted as raw-SQL-only, no drift.
• npm run typecheck
• npm run test:coverage locally, full unsharded run: 990 test files / 18484 tests passed, 0 failures. src/orb/broker.ts patch is 100% lines/branches/functions/statements — the file's one remaining branch gap (line 126, entry.permissions ?? {}) is pre-existing and untouched by this diff.
• npm run ui:openapi:check — no drift (this endpoint's response shape isn't part of the checked OpenAPI schema).
• npm audit --audit-level=moderate — one pre-existing high-severity finding (adm-zip via github-actionlint, no fix available), unrelated to this change.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — 4 new tests in test/integration/orb-broker.test.ts: issueOrbEnrollment defaults to github_token and records a caller-supplied type, brokerOrbToken refuses an unsupported-type row before touching install eligibility or App credentials, and the /v1/orb/token route maps that refusal to a 500.

Skipped (not applicable): npm run actionlint, npm run test:workers, npm run build:mcp, npm run test:mcp-pack, npm run ui:lint, npm run ui:typecheck, npm run ui:build — no .github/workflows/**, Workers-binding, mcp-package, or apps/loopover-ui/** changes in this diff.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests — the new unsupported_secret_type refusal is itself a negative-path addition, tested at both the function and HTTP-route level.
• API/OpenAPI/MCP behavior is updated and tested where needed — N/A, this endpoint isn't in the checked OpenAPI schema (matches existing /v1/orb/token precedent).
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks — N/A, no UI in this PR.
• Visible UI changes include a UI Evidence section — N/A, backend-only change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend-only change, no visible UI.

Notes

• The unsupported_secret_type check is ordered right after the enrollment-validity check and before the install-eligibility lookup — same "prove a valid enrollment before revealing anything else" ordering rationale as the existing broker_misconfigured check below it (fix(orb-broker): improve error handling for token exchange failures #2710): a row's secret type isn't caller-sensitive info, but there's no reason to spend a second DB query checking GitHub install state for a row this endpoint is about to refuse anyway.
• Mapped to HTTP 500 rather than 403/400: this is a data/config condition (a row recorded for a mint strategy that doesn't exist yet), not something the caller did wrong.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.77%. Comparing base (f889088) to head (85cec8f).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/api/routes.ts	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7187   +/-   ##
=======================================
  Coverage   93.77%   93.77%           
=======================================
  Files         694      694           
  Lines       68971    68975    +4     
  Branches    18796    18799    +3     
=======================================
+ Hits        64675    64679    +4     
  Misses       3302     3302           
  Partials      994      994           

Flag	Coverage Δ
shard-1	43.88% <83.33%> (+<0.01%)	⬆️
shard-2	37.14% <16.66%> (-0.01%)	⬇️
shard-3	33.10% <50.00%> (+<0.01%)	⬆️
shard-4	34.54% <16.66%> (-0.01%)	⬇️
shard-5	32.21% <16.66%> (-0.01%)	⬇️
shard-6	45.81% <16.66%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/orb/broker.ts	97.91% <100.00%> (+0.13%)	⬆️
src/api/routes.ts	95.02% <50.00%> (+<0.01%)	⬆️