feat(widget): two-step install with a lazy signing secret

[mortondev]

Summary

• Split widget install into launcher first, optional identify second, with a copy/reveal/regenerate signing secret on the install page.
• Mint settings.widget_secret lazily on the admin fetch (not workspace create). Public identify stays read-only.
• Stop telling Cloud and self-host users to set QUACKBACK_WIDGET_SECRET on Quackback. Same path for both.

Test plan

• Open Admin → Settings → Widget → Install on a workspace with no secret; a wgt_ secret appears.
• Copy the launcher snippet (identify off). Launcher works without a host-app secret.
• Reveal, copy, and regenerate the secret. Confirm dialog warns identify breaks; launcher does not.
• Turn on “Include identify…” and confirm the snippet/agent prompt mention identify and the secret, for a local agent only.
• Two admins opening Install at once still share one secret.

Made with Cursor

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[mortondev]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.