[COVAL-4344] Add dedicated managed-key credential

[callumreid]

Summary

• prefer a dedicated deployment-provided credential for managed user-key exchange
• preserve the current credential when the dedicated credential is absent
• during rollout overlap, retry the previous credential exactly once and only after an authentication rejection
• avoid fallback when credentials are equal or when the first request fails for a non-authentication reason

Rollout safety

• runtime behavior is unchanged until deployment provides the dedicated environment variable
• the compatibility fallback is intentionally narrow and does not mask availability or application failures
• no credential value, deployment configuration, release, or production state is included in this change

Validation

• focused managed-key tests: 10 passed
• full unit suite: 158 passed
• lint, typecheck, and build: passed
• git diff --check: passed

This is a compatibility change only; deployment and credential activation remain separately controlled.

Independent review fixes (2026-07-31)

Operator documentation now defines the dedicated hosted credential as primary and distinct from the shared fallback, pins immutable secret-version coordination, permits fallback exactly once only after explicit 401 authentication rejection, forbids fallback for timeouts, network failures, 403, and application failures, and documents bounded cutover, drain, removal, rollback, and telemetry expectations.

The full post-change suite remains green at 14 suites and 158 tests.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e6319c02-ce79-44d3-8b48-8fb4d3df66fa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}