feat(secrets): version-adaptive .env editor in the application editor

[dawsontoth]

Base of a stacked pair (the cluster-secrets slice sits on top in #1402). Everything this PR needs is already released in Harper: .env masking + key-level ops merged in HarperFast/harper#1527, and pre-5.2 versions work through the existing whole-file operations — so this can ship independently and quickly.

What

Secret-bearing .env files (duck-typed by basename at any depth, case-insensitive — .env, .env.local, .ENV.production; templates like .env.example / .sample / .template keep the plain text editor, matching core's exemptions) now open in a managed secrets panel instead of raw Monaco, so values aren't flashed on screen or clobbered by accident.

The panel adapts to the connected Harper by the shape of the get_component_file response, not a version check:

• Plaintext mode (pre-5.2, raw text returned): keys/values parsed client-side; values masked behind a per-row click-to-reveal (a deliberate action); add/edit/delete rewrite the whole file through the existing set_component_file — merge-preserving (comments, formatting, untouched keys stay byte-for-byte). An "Edit as text" escape hatch keeps raw Monaco available.
• Protected mode (>= 5.2, protected: true + masked message): key names only, nothing revealable, no raw editing (saving the masked rendering would destroy the real values — a footgun the plain editor would have had on 5.2); writes go through the key-level set_env_value / delete_env_value operations, whose responses update the key list without a refetch.

Pieces

• lib/env/envFile.ts — browser-safe port of core's utility/envFile.ts (dotenv-16 parse semantics, quote-aware merge-preserving upsert/remove), with core's test suite ported, so plaintext-mode edits produce exactly the file 5.2's server-side ops would.
• integrations/api/instance/applications/envValues.ts — set_env_value / delete_env_value hooks; get_component_file's response type gains the protected / keys fields.
• features/instance/applications/components/EnvEditorView/ — the panel + dispatch from ContentViewer; .env files get a key icon in the sidebar.
• features/instance/secrets/ — shared SecretsManager / SecretModals (masked table, click-to-reveal, add/edit dialogs with injected copy/persistence). The stacked cluster-secrets PR reuses these. Includes a fix for a latent react-hook-form subscription bug: a pasted value left Save permanently disabled because isValid was never read while the form was pristine.

Verification

• tsc, oxlint, dprint clean; full suite green (1079 tests, 43 new: core's ported envFile suite + EnvEditorView component tests asserting the exact operation payloads in both modes).
• Plaintext mode click-tested live against a running Studio on a real Fabric cluster (.env in an application): masked table, reveal/hide toggle, edit dialog revealing the current value only on demand (Save stays disabled until an actual change), raw-editor round-trip.
• Protected mode is covered by the component tests (no 5.2 instance available yet to click-test).

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.

[dawsontoth]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a dedicated secrets editor for .env files, providing a safer interface for managing environment variables by masking values and supporting key-level operations for protected files. The implementation includes a new EnvEditorView component, shared secret management modals, and robust utility functions for parsing and serializing .env files. The review feedback identified several improvements: using undefined instead of false for conditional hook arguments, improving the robustness of file path slicing, ensuring the EditSecretModal resets correctly via a unique key prop, and refining the regex used for quote stripping to avoid unintended multiline replacements.