feat: add coder secret import for bulk secret files (#27534)

Adds `coder secret import <file>` to bulk-import dotenv, JSON, or YAML
secrets through the existing batch API. The command infers the format
from the extension or accepts `--input-format`, supports non-interactive
stdin, validates files locally before upload, and warns when imported
keys cannot be injected as environment variables.

Reviewed and updated by Coder Agents on behalf of @dylanhuff-at-coder.

docs/manifest.json

@@ -2153,6 +2153,11 @@
 							"description": "Update a secret",
 							"path": "reference/cli/secret_update.md"
 						},
+						{
+							"title": "secret import",
+							"description": "Import secrets from a file",
+							"path": "reference/cli/secret_import.md"
+						},
 						{
 							"title": "secret list",
 							"description": "List secrets, or show one by name",

docs/reference/cli/secret.md

@@ -24,6 +24,10 @@ coder secret
 
      $ echo -n "$NEW_SECRET_VALUE" | coder secret update api-key --description "Rotated API key" --env API_KEY --file "~/.api-key"
 
+  - Import secrets from a file:
+
+     $ coder secret import ./secrets.env
+
   - List your secrets:
 
      $ coder secret list
@@ -43,6 +47,7 @@ coder secret
 |---------------------------------------------|---------------------------------------------------|
 | [<code>create</code>](./secret_create.md)   | Create a secret                                   |
 | [<code>update</code>](./secret_update.md)   | Update a secret                                   |
+| [<code>import</code>](./secret_import.md)   | Import secrets from a file                        |
 | [<code>enable</code>](./secret_enable.md)   | Enable a secret so it is injected into workspaces |
 | [<code>disable</code>](./secret_disable.md) | Disable a secret without removing it              |
 | [<code>list</code>](./secret_list.md)       | List secrets, or show one by name                 |

docs/reference/cli/secret_import.md

@@ -0,0 +1,26 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret import
+
+Import secrets from a file
+
+## Usage
+
+```console
+coder secret import [flags] <file>
+```
+
+## Description
+
+```console
+Every key in the file becomes a secret. Keys allowed as environment variable names are injected into workspaces under the same name. The import is all or nothing, and existing secrets are never overwritten. Pass - to read the file from non-interactive stdin (pipe or redirect).
+```
+
+## Options
+
+### --input-format
+
+|      |                              |
+|------|------------------------------|
+| Type | <code>env\|json\|yaml</code> |
+
+Format of the secrets file. Inferred from the file extension when unset, and required when reading from stdin.

docs/user-guides/user-secrets.md

@@ -217,6 +217,23 @@ want to store a trailing newline:
 echo -n "$API_KEY" | coder secret create api-key --env API_KEY
 ```
 
+### Import multiple secrets from a file
+
+Use `coder secret import <file>` to create a secret for every key in a dotenv,
+JSON, or YAML file. The format is inferred from the file extension. Pass `-`
+to read from non-interactive stdin, which requires `--input-format`:
+
+```sh
+coder secret import ./secrets.env
+
+coder secret import - --input-format yaml < ./secrets.yaml
+```
+
+The import is all or nothing and never overwrites existing secrets. Keys that
+are valid environment variable names are injected under the same name; other
+keys are imported without an environment variable target. For details, see
+[`coder secret import`](../reference/cli/secret_import.md).
+
 ### Create a disabled secret
 
 An enabled secret must set `--env`, `--file`, or both. To store a secret