fix(secrets): honor ops.secrets.read permission for reveal/list

A regular member granted reveal access either via the ops.secrets.read
role permission or a per-secret ops_acl entry could not actually see or
reveal secrets: revealSecret hard-gated on built-in role admin/board
(ignoring both the permission and the ACL), and secrets_select RLS never
consulted the permission, and the Ops page short-circuited the secrets
fetch by built-in role.

Migration 031 additively adds an OR user_has_permission(...,
'ops.secrets.read') branch to secrets_select; the admin/board and
per-secret ops_acl branches are unchanged so deployment is access-neutral
unless an admin has granted the permission. revealSecret now resolves
the member and lets RLS be the boundary (a denied row simply does not
return). The Ops page always queries secrets (RLS filters the set) and
shows the section to admin/board, a permission holder, or anyone with an
ACL-granted secret. Write paths (create/update/delete) are unchanged.
Mirrored in schema.sql; migration docs and HANDOFF updated.

scripts/schema.sql

@@ -1782,9 +1782,13 @@ CREATE POLICY ops_acl_delete ON public.ops_acl FOR DELETE
   USING (public.user_has_role_in_space(auth.uid(), space_id, ARRAY['admin','board']));
 
 DROP POLICY IF EXISTS secrets_select ON public.secrets;
+-- secrets_select also honors the ops.secrets.read role permission
+-- (equivalent to scripts/031_secrets_permission_select.sql). Additive: the
+-- admin/board and per-secret ops_acl branches are unchanged.
 CREATE POLICY secrets_select ON public.secrets FOR SELECT
   USING (
     public.user_has_role_in_space(auth.uid(), space_id, ARRAY['admin','board'])
+    OR public.user_has_permission(auth.uid(), space_id, 'ops.secrets.read')
     OR EXISTS (
       SELECT 1 FROM public.ops_acl a
       WHERE a.space_id = secrets.space_id AND a.entity_type = 'secret'