feat: add CLI support for user secrets (#24270)

Adds a coder secret command group for managing user secrets from the
CLI, with create, update, list, and delete subcommands backed by the
existing user secret API.

This branch adds CLI test coverage and refreshes the generated help
output and CLI reference docs for the new command group.

docs/reference/cli/index.md

@@ -35,6 +35,7 @@ Coder — A tool for provisioning self-hosted development environments with Terr
 | [<code>port-forward</code>](./port-forward.md)               | Forward ports from a workspace to the local machine. For reverse port forwarding, use "coder ssh -R".                        |
 | [<code>publickey</code>](./publickey.md)                     | Output your Coder public key used for Git operations                                                                         |
 | [<code>reset-password</code>](./reset-password.md)           | Directly connect to the database to reset a user's password                                                                  |
+| [<code>secret</code>](./secret.md)                           | Manage secrets                                                                                                               |
 | [<code>state</code>](./state.md)                             | Manually manage Terraform state to fix broken workspaces                                                                     |
 | [<code>task</code>](./task.md)                               | Manage tasks                                                                                                                 |
 | [<code>templates</code>](./templates.md)                     | Manage templates                                                                                                             |

docs/reference/cli/secret.md

@@ -0,0 +1,47 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret
+
+Manage secrets
+
+Aliases:
+
+* secrets
+
+## Usage
+
+```console
+coder secret
+```
+
+## Description
+
+```console
+  - Create a secret:
+
+     $ printf %s "$MYCLI_API_KEY" | coder secret create api-key --description "API key for workspace tools" --env API_KEY --file "~/.api-key"
+
+  - Update a secret:
+
+     $ echo -n "$NEW_SECRET_VALUE" | coder secret update api-key --description "Rotated API key" --env API_KEY --file "~/.api-key"
+
+  - List your secrets:
+
+     $ coder secret list
+
+  - Show a specific secret:
+
+     $ coder secret list api-key
+
+  - Delete a secret:
+
+     $ coder secret delete api-key
+```
+
+## Subcommands
+
+| Name                                      | Purpose                           |
+|-------------------------------------------|-----------------------------------|
+| [<code>create</code>](./secret_create.md) | Create a secret                   |
+| [<code>update</code>](./secret_update.md) | Update a secret                   |
+| [<code>list</code>](./secret_list.md)     | List secrets, or show one by name |
+| [<code>delete</code>](./secret_delete.md) | Delete a secret                   |

docs/reference/cli/secret_create.md

@@ -0,0 +1,50 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret create
+
+Create a secret
+
+## Usage
+
+```console
+coder secret create [flags] <name>
+```
+
+## Description
+
+```console
+Provide the secret value with --value or non-interactive stdin (pipe or redirect).
+```
+
+## Options
+
+### --value
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Set the secret value. For security reasons, prefer non-interactive stdin (pipe or redirect).
+
+### --description
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Set the secret description.
+
+### --env
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Name of the workspace environment variable that this secret will set.
+
+### --file
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Workspace file path where this secret will be written. Must start with ~/ or /.

docs/reference/cli/secret_delete.md

@@ -0,0 +1,25 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret delete
+
+Delete a secret
+
+Aliases:
+
+* remove
+* rm
+
+## Usage
+
+```console
+coder secret delete [flags] <name>
+```
+
+## Options
+
+### -y, --yes
+
+|      |                   |
+|------|-------------------|
+| Type | <code>bool</code> |
+
+Bypass confirmation prompts.

docs/reference/cli/secret_list.md

@@ -0,0 +1,40 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret list
+
+List secrets, or show one by name
+
+Aliases:
+
+* ls
+
+## Usage
+
+```console
+coder secret list [flags] [name]
+```
+
+## Description
+
+```console
+Secret values are omitted from the output.
+```
+
+## Options
+
+### -c, --column
+
+|         |                                                               |
+|---------|---------------------------------------------------------------|
+| Type    | <code>[created\|name\|updated\|env\|file\|description]</code> |
+| Default | <code>name,created,updated,env,file,description</code>        |
+
+Columns to display in table output.
+
+### -o, --output
+
+|         |                          |
+|---------|--------------------------|
+| Type    | <code>table\|json</code> |
+| Default | <code>table</code>       |
+
+Output format.

docs/reference/cli/secret_update.md

@@ -0,0 +1,50 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# secret update
+
+Update a secret
+
+## Usage
+
+```console
+coder secret update [flags] <name>
+```
+
+## Description
+
+```console
+At least one of --value, --description, --env, or --file must be specified. Provide the secret value by at most one of --value or non-interactive stdin (pipe or redirect).
+```
+
+## Options
+
+### --value
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Update the secret value. For security reasons, prefer non-interactive stdin (pipe or redirect).
+
+### --description
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Update the secret description. Pass an empty string to clear it.
+
+### --env
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Name of the workspace environment variable that this secret will set. Pass an empty string to clear it.
+
+### --file
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Workspace file path where this secret will be written. Must start with ~/ or /. Pass an empty string to clear it.