feat(secrets): add secret promotion between scopes

Adds ability to promote secrets from repository to organization scope, or from repository/organization to global scope. Includes conflict detection to prevent duplicate names at target scope, permission checks (org owner for repo→org, system admin for →global), and UI buttons with confirmation dialogs. Implements MoveSecret model method and PerformSecretsPromote handler.

services/secrets/secrets.go

@@ -130,6 +130,11 @@ func DeleteSecretByName(ctx context.Context, ownerID, repoID int64, name string)
 	return deleteSecret(ctx, s[0])
 }
 
+// PromoteSecret moves a secret to a new scope (org or global).
+func PromoteSecret(ctx context.Context, secretID, newOwnerID, newRepoID int64) error {
+	return secret_model.MoveSecret(ctx, secretID, newOwnerID, newRepoID)
+}
+
 func deleteSecret(ctx context.Context, s *secret_model.Secret) error {
 	if _, err := db.DeleteByID[secret_model.Secret](ctx, s.ID); err != nil {
 		return err