Q93: disconnect erases the secret here and revokes at the provider where it can

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/database/migrations/079-erase-retired-credentials.ts

@@ -0,0 +1,13 @@
+/** Credentials no provider uses any more lose their secret; their rows stay for history. */
+export const ERASE_RETIRED_CREDENTIALS_SQL = `
+  update credentials set ciphertext = x''
+  where id not in (select credential_id from providers where credential_id is not null)
+    and id not in (select credential_id from provider_auth_profiles where active = 1);
+`;
+
+export const eraseRetiredCredentialsSchema = `
+  ${ERASE_RETIRED_CREDENTIALS_SQL}
+
+  insert into schema_migrations(version, name, applied_at)
+  values (79, 'erase_retired_credentials', datetime('now'));
+`;

src/main/database/schema.ts

@@ -77,6 +77,7 @@ import { providerCooldownsSchema } from "./migrations/075-provider-cooldowns";
 import { runPinsSchema } from "./migrations/076-run-pins";
 import { modelChecksSchema } from "./migrations/077-model-checks";
 import { requestErrorCodesSchema } from "./migrations/078-request-error-codes";
+import { eraseRetiredCredentialsSchema } from "./migrations/079-erase-retired-credentials";
 
 interface Migration {
   version: number;
@@ -163,6 +164,7 @@ const MIGRATIONS: Migration[] = [
   { version: 76, name: "run_pins", sql: runPinsSchema },
   { version: 77, name: "model_checks", sql: modelChecksSchema },
   { version: 78, name: "request_error_codes", sql: requestErrorCodesSchema },
+  { version: 79, name: "erase_retired_credentials", sql: eraseRetiredCredentialsSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;