refactor(roles): finish renaming meta/schema.yml to meta/secrets.yml

Eleven roles still declared their credentials in meta/schema.yml while the
rest of the repository had moved to meta/secrets.yml. The name is not
cosmetic: the inventory resolves credentials at that path, as
d86913225b and c541e7c22f record, so a role left on the old name drops out
of that resolution.

All eleven are pure renames with no content change.

Also correct the four remaining places that still named the old path in
prose: the credentials reset CLI help, two test docstrings and the espocrm
README. None of them resolved a file, but they misdescribe where credentials
live, which is exactly what sent an earlier reader to the wrong location.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/administration/inventory/credentials/reset/cli.py

@@ -107,7 +107,7 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument(
         "--schema",
         action="store_true",
-        help="Rotate applications.<app>.credentials.* (everything meta/schema.yml generates).",
+        help="Rotate applications.<app>.credentials.* (everything meta/secrets.yml generates).",
     )
     parser.add_argument(
         "--users", action="store_true", help="Rotate users.<name>.password."

roles/web-app-espocrm/README.md

@@ -123,7 +123,7 @@ To connect EspoCRM to the platform gateway once a license is available:
 1. Obtain the extension ZIP and make it reachable from the stack host at deploy time.
 2. Install it inside the container with `bin/command extension --file="path/to/package.zip"`, or through Administration > Extensions, and confirm it with `bin/command extension --list`.
 3. Create the AI model entry under Administration > Intelligence panel > Settings, selecting the `Custom OpenAI-compatible` provider, and enter the API credentials under Administration > Integrations.
-4. Use `LITELLM_OPENAI_BASE_LOCAL_URL` as the base URL, `LITELLM_CHAT_MODEL` as the model name, and the role's own virtual key from `lookup('config', application_id, 'credentials.litellm_api_key')` as the API key. Re-add that credential to `meta/schema.yml` and the `litellm` service to `meta/services.yml` in the same change, so the gateway mints the key only once a consumer presents it.
+4. Use `LITELLM_OPENAI_BASE_LOCAL_URL` as the base URL, `LITELLM_CHAT_MODEL` as the model name, and the role's own virtual key from `lookup('config', application_id, 'credentials.litellm_api_key')` as the API key. Re-add that credential to `meta/secrets.yml` and the `litellm` service to `meta/services.yml` in the same change, so the gateway mints the key only once a consumer presents it.
 
 The field names on the provider record are only discoverable by unpacking the purchased artifact, so step 3 has to be measured against the extension actually installed rather than assumed from this note.
 

tests/integration/ansible/lookups/config/test_credentials_roundtrip.py

@@ -5,7 +5,7 @@
 ``applications.<app>.secrets.credentials``; every role then reads them through
 ``lookup('config', <app>, 'secrets.credentials.<key>')``. Nothing checked that
 the two agree on where the values live, which is exactly what the rename from
-``meta/schema.yml`` put at risk.
+``meta/secrets.yml`` put at risk.
 
 The second test guards the caching side of that seam: the assembled defaults
 must not reach into the YAML cache and truncate the schema every later reader

tests/lint/ansible/jinja/test_model_backend_via_gateway.py

@@ -67,7 +67,7 @@ class TestModelBackendViaGateway(unittest.TestCase):
                 f"routing through {_GATEWAY_ROLE}, so their traffic carries no "
                 "consumer identity and ignores the gateway's model list.\n\n"
                 "Fix: declare `services.litellm` in the role's meta/services.yml "
-                "and a `litellm_api_key` credential in its meta/schema.yml, then "
+                "and a `litellm_api_key` credential in its meta/secrets.yml, then "
                 "point the application at LITELLM_BASE_LOCAL_URL with that key. "
                 "The gateway provisions the virtual key for every role that "
                 "declares both.\n\n"