feat(vault): add Scaleway Secret Manager provider

Adds Scaleway Secret Manager as a first-class vault provider alongside
HashiCorp Vault/OpenBao, Infisical, AWS, Doppler and Azure Key Vault.

- New `scaleway` provider type, zod-validated config (region, project ID,
  API secret key, overridable API URL) and migration adding the enum value
- Plain `fetch` client (no new dependency) against the Secret Manager
  v1beta1 REST API: access-by-path for reads, paginated listing for the
  env editor autocomplete, and a connection test
- Refs are `[folder/]name[:field]` — the field selector extracts a key
  from JSON/key-value secrets, like the AWS provider
- Secret key masked in API responses like every other provider credential
- Settings -> Secrets form with region picker, brand icon and reference
  format help

packages/server/src/db/schema/vault-provider.ts

@@ -10,6 +10,7 @@ export const vaultProviderType = pgEnum("VaultProviderType", [
 	"aws",
 	"doppler",
 	"azure",
+	"scaleway",
 ]);
 
 export const hashicorpVaultConfigSchema = z.object({
@@ -53,12 +54,21 @@ export const azureVaultConfigSchema = z.object({
 	clientSecret: z.string().min(1),
 });
 
+export const scalewayVaultConfigSchema = z.object({
+	providerType: z.literal("scaleway"),
+	region: z.string().min(1).default("fr-par"),
+	projectId: z.string().min(1),
+	secretKey: z.string().min(1),
+	apiUrl: z.string().url().default("https://api.scaleway.com"),
+});
+
 export const vaultProviderConfigSchema = z.discriminatedUnion("providerType", [
 	hashicorpVaultConfigSchema,
 	infisicalVaultConfigSchema,
 	awsVaultConfigSchema,
 	dopplerVaultConfigSchema,
 	azureVaultConfigSchema,
+	scalewayVaultConfigSchema,
 ]);
 
 export type VaultProviderConfig = z.infer<typeof vaultProviderConfigSchema>;