feat: configure workspace runtime secrets through API

backend/src/config.ts

@@ -30,6 +30,8 @@ export interface AppConfig {
   legacyWorkspaceMode: boolean;
   workspaceDiagnosticTimeoutMs: number;
   workspaceRegistry: WorkspaceRegistryConfig;
+  workspaceSecretStoreRoot: string;
+  workspaceSecretRuntimeRoot: string;
   internalQdrantUrl: string;
   internalEmbeddingUrl: string;
   internalEmbeddingModel: string;
@@ -248,6 +250,14 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     maxEvidencePathBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_PATH_BYTES, 4096),
     maxEvidenceManifestBytes: positiveImportLimit(env.THT_WORKSPACE_MAX_EVIDENCE_MANIFEST_BYTES, 1024 * 1024),
   };
+  const workspaceSecretStoreRoot = absoluteRegistryPath(
+    env.THT_WORKSPACE_SECRET_STORE_ROOT ?? path.join(path.dirname(registryRoot), "workspace-secrets"),
+    "secret store root",
+  );
+  const workspaceSecretRuntimeRoot = absoluteRegistryPath(
+    env.THT_WORKSPACE_SECRET_RUNTIME_ROOT ?? "/tmp/thothii-workspace-secrets",
+    "secret runtime root",
+  );
   const settingsFile = env.SETTINGS_FILE ?? "data/settings.json";
   const internalQdrantUrl = internalServiceUrl(
     env.THT_INTERNAL_QDRANT_URL,
@@ -284,6 +294,8 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     legacyWorkspaceMode: legacyWorkspaceMode === "local",
     workspaceDiagnosticTimeoutMs: diagnosticTimeout(env.THT_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS),
     workspaceRegistry,
+    workspaceSecretStoreRoot,
+    workspaceSecretRuntimeRoot,
     internalQdrantUrl,
     internalEmbeddingUrl,
     internalEmbeddingModel: env.THT_INTERNAL_EMBEDDING_MODEL ?? "qwen3-embedding:0.6b",