feat: add AI catalog description generation

backend/test/secret-bundle.test.ts

@@ -2,7 +2,12 @@ import { afterEach, expect, test } from "vitest";
 import { chmodSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { loadSecretBundle, loadSecretBundleWithFs, secretValue } from "../src/config/secret-bundle.js";
+import {
+  loadSecretBundle,
+  loadSecretBundleWithFs,
+  METADATA_GENERATION_SECRET_KEYS,
+  secretValue,
+} from "../src/config/secret-bundle.js";
 
 const dirs: string[] = [];
 afterEach(() => { for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true }); });
@@ -22,6 +27,15 @@ test("parses comments, blank lines and values containing equals", () => {
   ]));
 });
 
+test("existing secret consumers accept a bundle containing an allowed metadata-model key", () => {
+  const file = bundle("THT_DWH_API_KEY=dwh-secret\nOPENAI_API_KEY=metadata-secret\n");
+  expect(secretValue({ secretsFile: file }, "THT_DWH_API_KEY")).toBe("dwh-secret");
+});
+
+test.each(METADATA_GENERATION_SECRET_KEYS)("accepts audited metadata-model key %s", (name) => {
+  expect(loadSecretBundle(bundle(`${name}=metadata-secret\n`)).get(name)).toBe("metadata-secret");
+});
+
 test("accepts the fixed OIDC and Authentik secret references", () => {
   const file = bundle("THT_OIDC_CLIENT_SECRET=oidc-secret\nTHT_AUTHENTIK_API_TOKEN=authentik-token\n");
   expect(loadSecretBundle(file)).toEqual(new Map([