feat: let administrators view and copy encrypted integration credentials

deploy/local/compose.yml

@@ -1,5 +1,14 @@
 # 叠加 deploy/docker-compose.yml；使用 scripts/orbit-local.py 固定项目和私密配置。
 services:
+  credential-key-init:
+    image: mysql:8.4
+    restart: "no"
+    user: "0:0"
+    entrypoint: ["/bin/sh", "-ec"]
+    command: ["cp /source/credential-keys.json /keys/credential-keys.json.tmp && chown 65532:65532 /keys /keys/credential-keys.json.tmp && chmod 700 /keys && chmod 600 /keys/credential-keys.json.tmp && mv /keys/credential-keys.json.tmp /keys/credential-keys.json"]
+    volumes:
+      - ${ORBIT_LOCAL_DIRECTORY}/credential-keys.json:/source/credential-keys.json:ro
+      - orbit-keys:/keys
   archive-init:
     image: mysql:8.4
     restart: "no"
@@ -17,6 +26,7 @@ services:
     command: ["verify"]
     environment:
       ORBIT_MYSQL_DSN: "root:${ORBIT_DB_ROOT_PASSWORD}@tcp(mysql:3306)/${ORBIT_DB_NAME}?parseTime=true&multiStatements=true"
+      ORBIT_CREDENTIAL_KEY_FILE: /run/local/credential-keys.json
     volumes:
       - ${ORBIT_LOCAL_DIRECTORY}:/run/local
 
@@ -29,16 +39,20 @@ services:
         REVISION: ${ORBIT_BUILD_REVISION}
         BUILD_TIME: ${ORBIT_BUILD_TIME}
     depends_on:
+      credential-key-init:
+        condition: service_completed_successfully
       archive-init:
         condition: service_completed_successfully
     environment:
       ORBIT_CONSOLE_APPLICATION_ADMIN: admin
+      ORBIT_CREDENTIAL_KEY_FILE: /run/orbit-keys/credential-keys.json
       ORBIT_ARCHIVE_ROOT: /var/lib/orbit/archives
       ORBIT_ARCHIVE_STORAGE_ID: ${ORBIT_ARCHIVE_STORAGE_ID}
       ORBIT_ARCHIVE_MAX_BYTES: 1073741824
       ORBIT_ARCHIVE_TICK_INTERVAL: 10s
     volumes:
       - orbit-archives:/var/lib/orbit/archives
+      - orbit-keys:/run/orbit-keys:ro
     networks:
       default:
       services:
@@ -56,4 +70,5 @@ networks:
         - subnet: ${ORBIT_TEST_SERVICES_SUBNET:-10.253.241.0/24}
 
 volumes:
+  orbit-keys:
   orbit-archives: