Rename the import package app to fluksio

A wheel whose top-level module is `app` collides with anything else in a
user's venv, so the package that is about to be published takes the name
it is published under. Only the Python package moves; the repo, the
Docker WORKDIR and the compose project keep theirs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/api/routes/secrets.py

@@ -0,0 +1,51 @@
+"""Credentials for node integrations.
+
+Values go in and are never handed back out — the API only ever lists names.
+"""
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.concurrency import run_in_threadpool
+from pydantic import BaseModel
+
+from fluksio.api.deps import get_current_user
+from fluksio.flow.secrets import SecretNotFound, get_secrets
+from fluksio.models import Message
+
+router = APIRouter(
+    prefix="/secrets", tags=["secrets"], dependencies=[Depends(get_current_user)]
+)
+
+
+class SecretNames(BaseModel):
+    data: list[str]
+    count: int
+
+
+class SecretValue(BaseModel):
+    value: str
+
+
+@router.get("/", response_model=SecretNames)
+def read_secrets() -> Any:
+    """List the names of stored secrets."""
+    names = get_secrets().list()
+    return SecretNames(data=names, count=len(names))
+
+
+@router.put("/{name}", response_model=Message)
+async def save_secret(name: str, body: SecretValue) -> Any:
+    """Store a secret under a name that nodes can reference."""
+    await run_in_threadpool(get_secrets().set, name, body.value)
+    return Message(message=f"Saved secret '{name}'")
+
+
+@router.delete("/{name}", response_model=Message)
+async def delete_secret(name: str) -> Any:
+    """Delete a secret."""
+    try:
+        await run_in_threadpool(get_secrets().delete, name)
+    except SecretNotFound:
+        raise HTTPException(status_code=404, detail=f"No secret named '{name}'")
+    return Message(message=f"Deleted secret '{name}'")