feat: add AI catalog description generation

backend/src/config/secret-bundle.ts

@@ -8,12 +8,19 @@ import {
   isUsableAuthenticationSecret,
 } from "../auth/secret-policy.js";
 
+/** Credential names that metadata-generation model entries may reference. */
+export const METADATA_GENERATION_SECRET_KEYS = Object.freeze([
+  "THT_METADATA_API_KEY", "ANTHROPIC_API_KEY", "AZURE_API_KEY", "GEMINI_API_KEY",
+  "DEEPSEEK_API_KEY", "OPENAI_API_KEY", "OPENROUTER_API_KEY", "ZAI_API_KEY",
+] as const);
+
 /** Keys accepted by the deployment bundle.  Keep this list intentionally explicit. */
 export const SECRET_BUNDLE_KEYS = Object.freeze([
   "THT_MODEL_API_KEY", "THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY",
   "THT_CA", "THT_SSL_CA", "THT_VECTOR_BOOTSTRAP_PASSWORD", "THT_VECTOR_MIGRATOR_PASSWORD",
   "THT_VECTOR_READER_PASSWORD", "THT_VECTOR_WRITER_PASSWORD", "PI_PROVIDER_API_KEY",
   "THT_OIDC_CLIENT_SECRET", "THT_AUTHENTIK_API_TOKEN",
+  ...METADATA_GENERATION_SECRET_KEYS,
 ] as const);
 
 const ALLOWED = new Set<string>(SECRET_BUNDLE_KEYS);