provision-secrets: add flowagent_* case-entry to the ai) stack (matched pair with ai.yaml's mcpo cutover)

Surgical addition to the existing case "ai)" block only — every other
case, comment, and line in this ~26KB pipeline file is byte-for-byte
unchanged from main. Given this file's documented incident history from
prior full-file rewrites (see header comment), this was hand-verified
against the current main content line-by-line before writing, not
generated fresh.

Adds:
  - 3 new environment: entries (FLOWAGENT_AZURE_CLIENT_ID/TENANT_ID/
    CLIENT_SECRET) via from_secret, alongside the existing ai_* secrets
  - Inside the existing `ai)` case, after the ai.env rewrite block: three
    create_or_update_secret calls provisioning flowagent_azure_client_id,
    flowagent_azure_tenant_id, flowagent_azure_client_secret as native
    Docker Swarm secrets (Pattern C, _FILE convention) — NOT written into
    ai/ai.env, since mcpo's flowagent entry reads them via
    /run/secrets/flowagent_azure_* per flowagent/entrypoint.sh, not env vars
  - A short comment explaining why these three are Pattern C secrets
    inside an otherwise Pattern-B (host .env) stack case

This is the matched-pair companion to the ai.yaml commit in this same PR,
per the FlowAgent progress note's explicit sequencing requirement (both
land together, reviewed, not auto-merged to main).

.woodpecker/deploy.yml

@@ -179,6 +179,12 @@ steps:
         from_secret: ai_open_webui_database_url
       AI_OAUTH_CLIENT_SECRET:
         from_secret: ai_oauth_client_secret
+      FLOWAGENT_AZURE_CLIENT_ID:
+        from_secret: flowagent_azure_client_id
+      FLOWAGENT_AZURE_TENANT_ID:
+        from_secret: flowagent_azure_tenant_id
+      FLOWAGENT_AZURE_CLIENT_SECRET:
+        from_secret: flowagent_azure_client_secret
     commands:
       - apk add --no-cache openssh-client
       - mkdir -p ~/.ssh
@@ -305,6 +311,13 @@ steps:
               # unresolved at compose-render time (empty), silently breaking Bedrock auth.
               # All other migrated vars in ai.yaml use plain (unprefixed) names, so only
               # these two lines need the AI_ prefix.
+              #
+              # FLOWAGENT NOTE (added alongside the ai.yaml mcpo image/secrets cutover):
+              # the 3 flowagent_azure_* values are provisioned as native Docker secrets
+              # below (Pattern C, matches every other _FILE-convention stack), NOT written
+              # into ai/ai.env — mcpo's flowagent entry reads them via
+              # /run/secrets/flowagent_azure_* (see mcp-config/flowagent/entrypoint.sh),
+              # not via env var, so they don't belong in this stack's Pattern B .env block.
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "FILE=/volume1/docker/compose-files/ai/ai.env
                 TMP=\$FILE.tmp.\$\$
                 grep -vE '^(AI_AWS_ACCESS_KEY_ID|AI_AWS_SECRET_ACCESS_KEY|LITELLM_MASTER_KEY|LITELLM_SALT_KEY|POSTGRES_PASSWORD|DATABASE_URL|WEBUI_SECRET_KEY|OPEN_WEBUI_DATABASE_URL|OAUTH_CLIENT_SECRET)=' \$FILE > \$TMP 2>/dev/null || touch \$TMP
@@ -320,7 +333,11 @@ steps:
                   printf 'OAUTH_CLIENT_SECRET=%s\n' '$${AI_OAUTH_CLIENT_SECRET}'
                 } > \$FILE
                 rm -f \$TMP
-                echo '  [OK] ai/ai.env secrets updated'";;
+                echo '  [OK] ai/ai.env secrets updated'
+                source /tmp/cs.sh
+                create_or_update_secret 'flowagent_azure_client_id'     '$${FLOWAGENT_AZURE_CLIENT_ID}'
+                create_or_update_secret 'flowagent_azure_tenant_id'     '$${FLOWAGENT_AZURE_TENANT_ID}'
+                create_or_update_secret 'flowagent_azure_client_secret' '$${FLOWAGENT_AZURE_CLIENT_SECRET}'";;
             entertainment)
               ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} "source /tmp/cs.sh
                 create_or_update_secret 'entertainment_discord_token'          '$${ENTERTAINMENT_DISCORD_TOKEN}'