Wire control-plane's real injectSecrets/revokeSecrets against the broker (implements #7852)

[JSONbored]

Problem

Split from #7852. Once #8064 lands (a real tenant-DB-credential secret type + revoke path on the main app's broker), control-plane's TenantProvisioningDriver.injectSecrets/revokeSecrets (control-plane/src/tenant-provisioning-driver.ts) can be implemented for real. control-plane/'s own Worker has no D1 binding of its own — src/orb/broker.ts is 100% D1-bound — and there is no Worker-to-Worker service-binding precedent anywhere in this repo (confirmed: zero services: entries in any wrangler.jsonc). The established pattern to reuse instead is the one self-hosted containers already use: POST /v1/internal/orb/enrollments to mint an enrollment, POST /v1/orb/token to exchange it — the same two-step HTTP call, just from a different physical caller (control-plane's Worker instead of a self-hosted container).

Separately: provisionTenant (control-plane/src/provisioning.ts) already captures provisionDatabase's real connection details (#7653) into its own result, but currently discards them before calling injectSecrets — that function's own header comment already flags this as a known, deliberate gap left for this issue to close.

Area

control-plane/src/tenant-provisioning-driver.ts, control-plane/src/provisioning.ts, a new control-plane/src/secret-driver.ts (or similar name).

Proposal

• Widen whatever's needed (TenantProvisioningRequest, or injectSecrets's own parameter list) so provisionTenant's already-captured database: DatabaseConnectionDetails actually reaches injectSecrets, instead of being silently dropped as it is today.
• Implement a real secret driver mirroring the existing withRealDatabaseDriver/withRealContainerDriver composition pattern: injectSecrets calls the main app's admin-authenticated HTTP endpoints to store the tenant's DB credential under Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064's new secret type; revokeSecrets calls its revoke path.
• Never log, return in an error message, or otherwise surface the raw secret value outside the broker's own storage.

Deliverables

• provisionTenant threads provisionDatabase's real connection details into injectSecrets.
• Real injectSecrets/revokeSecrets calling the main app's broker HTTP endpoints (admin-token-authenticated, Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064's new secret type).
• Idempotent revoke (matching every other driver's teardown contract: revoking an unconfigured/already-revoked tenant is a no-op, never a throw).
• Tests against a realistically-mocked HTTP boundary — no live secrets, no live broker calls, no live main-app deployment anywhere in the test suite (same constraint Real Postgres/Hyperdrive driver for control-plane's provisionDatabase/deprovisionDatabase #7653/Real Cloudflare Containers driver for control-plane's createContainer/destroyContainer/containerExists #7851 already established for this package).

Resources

• Real secret-injection driver for control-plane's injectSecrets/revokeSecrets via the generalized broker #7852 (parent)
• Add a tenant-DB-credential secret type + generic revoke path to src/orb/broker.ts #8064 (blocking — the broker-side secret type/revoke path this calls)
• control-plane/src/neon-database-driver.ts (the "real driver calls out over HTTP" shape to mirror)
• control-plane/src/driver-factory.ts (withRealDatabaseDriver/withRealContainerDriver — the composition pattern to extend)
• src/api/routes.ts (POST /v1/orb/token, POST /v1/internal/orb/enrollments — the existing routes to call)

Boundaries

Control-plane wiring only — does not implement the broker-side secret type/revoke mechanism itself (#8064, separate, blocking this one). Does not touch container creation (#7851, already shipped) or database provisioning (#7653, already shipped).

maintainer-only — handles real tenant secrets in transit, not a first-pass contributor task.

[linear-code]

JSO-5572