Add durable credential registry and secret lifecycle

crates/remora-credentials/src/migrate.rs

@@ -0,0 +1,19 @@
+use remora_durable::DurableError;
+use sqlx::PgPool;
+
+/// Separate migration history from the DurableStore substrate so feature-package
+/// versions do not collide with `remora-durable` in `_sqlx_migrations`.
+const MIGRATION_TABLE: &str = "_remora_credentials_migrations";
+
+pub async fn migrate(pool: &PgPool) -> Result<(), DurableError> {
+    let mut migrator = sqlx::migrate!("./migrations");
+    migrator.dangerous_set_table_name(MIGRATION_TABLE);
+    migrator.run(pool).await?;
+    Ok(())
+}
+
+pub fn migrator() -> sqlx::migrate::Migrator {
+    let mut migrator = sqlx::migrate!("./migrations");
+    migrator.dangerous_set_table_name(MIGRATION_TABLE);
+    migrator
+}