fix(api): include global secrets when listing for a workspace

[genisd]

Summary

Since the task configs were assigned a workspace (Aug 10), tasks spawned from them pass a workspaceId into resolveSecretsForSetup(). listSecrets() then filtered strictly on workspace_id = <ws>, which excludes every global secret (stored with workspace_id = NULL) — so repo pods stopped receiving setup secrets like SLACK_WEBHOOK_URL, and agents could no longer send the Slack "PR created" notifications.

Global secrets apply to every workspace: listSecrets() now matches workspace_id = <ws> OR workspace_id IS NULL when a workspace is given. Per-name resolution already had a correct workspace→global fallback (retrieveSecretWithFallback), so workspace-scoped secrets still override global ones with the same name. Side effect: GET /api/secrets now also lists global secret names for workspace members, consistent with what their tasks actually receive.

Changes

• api/secret-service: listSecrets(scope, workspaceId) includes NULL-workspace rows when workspaceId is set
• tests: replaced the mock's condition parser (AND-only, ignored isNull) with a recursive evaluator supporting eq/and/or/isNull; added regression tests for workspace-scoped listing and setup-secret resolution

Testing

Three new tests reproduce the bug (fail before the fix, pass after). Decryption path verified: global rows are AAD-bound to name|scope|global, and the fallback retrieval builds the identical AAD.

• Tests pass (pnpm turbo test)
• Typechecks pass (pnpm turbo typecheck)