feat: service accounts

[rohan-chaturvedi]

🔍 Overview

Currently, programmatic access to secrets in Phase can be achieved primarily via Service Tokens. These have significant limitations:

• Cannot be restricted in their permissions (read, write, delete, etc)
• Limited to a single app
• Cannot be restricted to a path / folder
• Cannot be used directly with third-party programmatic authentication schemes, such as AWS auth, Kubernetes auth, etc

💡 Proposed Changes

Add service accounts to allow for more sophisticated workflows around programmatic secret management. Service accounts are the machine equivalent of human users, and operate in much the same way:

• Secured with encryption keys unique to each account
• Can be granted access to multiple apps and envs, just like human users
• Can be assigned a role to restrict access to resources and actions (ex: only allow a service account Secrets:read permission)

Service accounts also lays the foundation for more sophisticated authentication and access control, including third-party auth, path-based access, IP-base access and other features that we will be shipping in the near future

🖼️ Screenshots or Demo

📝 Release Notes

Added Service accounts

💚 Did You...

• Ensure linting passes (code style checks)?
• Update dependencies and lockfiles (if required)
• Regenerate graphql schema and types (if required)
• Verify the app builds locally?
• Manually test the changes on different browsers/devices?