feat: add secure peer quick links

[roziscoding]

Summary

• add a ConfigSecret-backed external Jack access profile
• generate dedicated, revocable jack-link:v1 credentials through the management API
• add secure copy/import flows that prefill the existing editable peer form
• validate URL credentials, reserved/dangerous/duplicate headers, payload size, and API-key cleanup on failure

Verification

• 511 tests pass
• backend and UI typechecks pass
• lint passes
• Nuxt production build passes
• independent security/code review approved the remediated diff

[github-actions]

🐳 Docker images published

This PR has been built and pushed to GHCR:

ghcr.io/roziscoding/jack:pr-85        # backend
ghcr.io/roziscoding/jack-ui:pr-85     # management UI

Pull them locally:

docker pull ghcr.io/roziscoding/jack:pr-85
docker pull ghcr.io/roziscoding/jack-ui:pr-85

Run the backend standalone:

docker run --rm ghcr.io/roziscoding/jack:pr-85

The UI needs the backend + a management key, so run the two together with examples/docker-compose.yml, overriding the image tags to pr-85.

Last built from commit 0d00cf0. Heads up: these images are automatically deleted when the PR is closed.

[greptile-apps]

Greptile Summary

Adds secure, revocable peer quick links backed by a configurable external Jack access profile.

• Adds external URL and secret-backed header configuration with strict URL and header validation.
• Adds a management-only endpoint that creates a dedicated API key and embeds it in a size-limited quick-link payload.
• Adds UI flows to generate, copy, import, review, and save peer quick links.
• Adds backend and frontend coverage for credential resolution, malformed payloads, dangerous headers, cleanup, and route isolation.

Confidence Score: 5/5

The PR appears safe to merge; no concrete blocking or independently actionable non-blocking defects were identified.

The new credential generation route remains management-key protected, validates and resolves the external profile before issuing a key, cleans up keys after encoding failures, and the import path strictly validates untrusted payloads before presenting them for review.

_{Reviews (1): Last reviewed commit: "feat: add secure peer quick links" | Re-trigger Greptile}