feat: Secrets Store CREDENTIALS_KEY, Create token menu, Remember + Environment, R2 chat archive

[implemented.stream (thanabartbb)]

Do not deploy until the prerequisites below are done. The owner approves deploys separately.

What

1. CREDENTIALS_KEY via Cloudflare Secrets Store. The store secret CREDENTIALS_KEY was created in default_secrets_store (b56dddabe7d74172932cf26f4a2ab03f) on 2026-10-15 20:47 ICT. It is 32 random bytes in base64, piped from openssl into wrangler secrets-store secret create, so it was never printed or written to disk. Per the owner's decision there is no backup. The secrets_store_secrets binding is in wrangler.jsonc. Code reads it with await env.CREDENTIALS_KEY.get(), cached per isolate, and falls back to a plain Worker secret, then to legacy v1. Existing v1 rows are re-sealed as v2 on first use after the deploy.
2. Create token menu (src/components/tokens/create-token-menu.tsx) is next to every token input: Connections (Cloudflare, OpenAI), the direct-deploy one-off token, the AI agent panel, Sandbox Factory and Environment. It links to Cloudflare API tokens, GitHub fine-grained tokens, OpenAI API keys, Vercel tokens and Hugging Face tokens. Each URL was checked in the provider's docs (see the verification doc). The style is monochrome and it is our own component, with no 21st.dev code.
3. Remember checkbox, off by default. Off means the token is used once for that request and never stored. On means it is sealed with v2 into /settings/environment, which shows only the name and created, updated and last-used dates, with a delete button. Changes:
   • Migration 0012_user_environment.sql.
   • API: GET/POST /api/environment and DELETE /api/environment/:name.
   • Connections PUT saves only when remember: true.
   • A deploy accepts a one-off {token, accountId, remember}. With no stored connection, the deploy (including the chat bot's deploy) falls back to the remembered CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID.
   • Factory no longer keeps the key in sessionStorage.
4. R2 chat stream archive. A CHAT_STREAMS binding points to bucket nvx-chat-streams. Each turn is written to chat/<uid>/<conversationId>/<messageId>.json. Deltas are merged, and reasoning and quota events are dropped. D1 history and the UI are unchanged. Archiving never breaks a turn.
5. The CI build step is in its own PR, ci: add next build to the check job #27.

Fixes found while verifying

• Under the dev proxy, get() returned a non-native thenable. It is now wrapped in a Promise.
• Pre-existing since PR-A: gate() reads were throttled by the fixed 4/60 s NVX_CHAT_LIMITER binding, so deploy-status polling every 3 s got 429 in production. Reads now use the per-isolate limiter. Writes are unchanged.

Verified

• 3 local rounds, each 17/17. Details in docs/verification/env-remember-rounds.md.
• Node 20: lint, typecheck, 351 tests, docs:check.
• npm run build passes.

Before deploy (owner)

• The R2 bucket must exist. The API still answered Please enable R2 through the Cloudflare Dashboard [10042] for account 2d92bd5b… at 20:47 and 20:54 ICT. After enabling R2 on that account, run wrangler r2 bucket create nvx-chat-streams. Otherwise the deploy fails on the binding.
• Apply migration 0012 remotely: wrangler d1 migrations apply nvx-db --remote.

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 065e88e:

Sandbox	Source
devstack-my-button	Configuration