Add secrets docs and consolidate SDK references (#69)

Author: motatoes

docs/cli/projects.mdx

@@ -0,0 +1,52 @@
+---
+title: "Secrets"
+description: "Manage secret stores and secrets from the CLI"
+---
+
+## Secret stores
+
+```bash
+# Create a store (with optional egress restrictions)
+oc secret-store create --name my-secrets --egress-allowlist api.anthropic.com
+
+# List stores
+oc secret-store list
+
+# Update a store
+oc secret-store update <store-id> --egress-allowlist api.anthropic.com,*.openai.com
+
+# Delete a store (and all its secrets)
+oc secret-store delete <store-id>
+```
+
+## Secrets
+
+```bash
+# Set a secret
+oc secret set <store-id> ANTHROPIC_API_KEY sk-ant-...
+
+# Set from stdin
+echo "sk-ant-..." | oc secret set <store-id> ANTHROPIC_API_KEY --from-stdin
+
+# Restrict a secret to specific hosts
+oc secret set <store-id> ANTHROPIC_API_KEY sk-ant-... --allowed-hosts api.anthropic.com
+
+# List secrets (names only — values are never returned)
+oc secret list <store-id>
+
+# Delete a secret
+oc secret delete <store-id> ANTHROPIC_API_KEY
+```
+
+## Using secrets in sandboxes
+
+```bash
+# Create a sandbox with a secret store
+oc create --secret-store my-secrets
+
+# Env vars are sealed — real values are never in the VM
+oc exec <sandbox-id> -- echo '$ANTHROPIC_API_KEY'
+# osb_sealed_7f3a9c... (not the real key)
+```
+
+For how secrets work under the hood, see [Secrets](/sandboxes/secrets).

docs/cli/secrets.mdx

@@ -53,6 +53,7 @@
         "sandboxes/interactive-terminals",
         "sandboxes/checkpoints",
         "sandboxes/templates",
+        "sandboxes/secrets",
         "sandboxes/patches",
         "sandboxes/preview-urls"
       ]
@@ -66,7 +67,8 @@
         "cli/shell",
         "cli/checkpoint",
         "cli/patch",
-        "cli/preview"
+        "cli/preview",
+        "cli/secrets"
       ]
     },
     {