cmd, config, demo : commande serve, secrets venant de la base, mode démo

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015a8P6WMRPeqdpd5VCh6jAy

internal/config/config.go

@@ -30,6 +30,10 @@ type Cluster struct {
 	Fingerprint     string `yaml:"fingerprint,omitempty"`
 	Insecure        bool   `yaml:"insecure,omitempty"`
 	Timeout         string `yaml:"timeout,omitempty"`
+
+	// Set by the web UI from its database, never read from nor written to YAML.
+	Secret string `yaml:"-"` // token secret, decrypted
+	CAPEM  string `yaml:"-"` // CA bundle, PEM
 }
 
 // Client is a target cluster with its mapping (kind -> id -> field -> value)
@@ -74,6 +78,9 @@ func Load(file string) (*Config, error) {
 	return &c, c.validate()
 }
 
+// Validate checks a configuration built elsewhere (web UI database, YAML import).
+func (c *Config) Validate() error { return c.validate() }
+
 func (c *Config) validate() error {
 	var errs []error
 	seen := map[string]bool{}
@@ -86,7 +93,7 @@ func (c *Config) validate() error {
 			errs = append(errs, fmt.Errorf("cluster %s: duplicate name", cl.Name))
 		}
 		seen[cl.Name] = true
-		if cl.TokenSecretEnv == "" && cl.TokenSecretFile == "" {
+		if cl.Secret == "" && cl.TokenSecretEnv == "" && cl.TokenSecretFile == "" {
 			errs = append(errs, fmt.Errorf("cluster %s: token_secret_env or token_secret_file is required", cl.Name))
 		}
 	}
@@ -158,11 +165,18 @@ func (cl Cluster) PVE() (*pve.Client, error) {
 	}
 	return pve.New(pve.Options{
 		Name: cl.Name, BaseURL: cl.URL, TokenID: cl.TokenID, TokenSecret: secret,
-		CAFile: cl.CAFile, Fingerprint: cl.Fingerprint, Insecure: cl.Insecure, Timeout: timeout,
+		CAFile: cl.CAFile, CAPEM: []byte(cl.CAPEM), Fingerprint: cl.Fingerprint, Insecure: cl.Insecure, Timeout: timeout,
 	})
 }
 
+// ResolveSecret reads the token secret from the environment variable or file of
+// the YAML configuration (used when a YAML file is imported in the web UI).
+func (cl Cluster) ResolveSecret() (string, error) { return cl.secret() }
+
 func (cl Cluster) secret() (string, error) {
+	if cl.Secret != "" {
+		return cl.Secret, nil
+	}
 	if cl.TokenSecretEnv != "" {
 		if v := os.Getenv(cl.TokenSecretEnv); v != "" {
 			return v, nil