feat: merge device on duplicate POST, Vault fallback for credentials

[amarnath-ac]

• Device POST upserts: on a duplicate GUID, merge the supplied fields
  into the stored device and return 200 instead of 409.
• Read AMT_PASSWORD and MPS_PASSWORD from Vault at devices/{guid} when
  no password is stored, for device management, AMT Explorer, CIRA and
  redirection.
• Do not write a Vault-only password back to the device row, so Vault
  stays the source of truth.

[codecov]

Codecov Report

❌ Patch coverage is 90.66667% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.88%. Comparing base (6ab185c) to head (cfc2410).

Files with missing lines	Patch %	Lines
internal/mocks/devicemanagement_mocks.go	0.00%	3 Missing ⚠️
internal/usecase/devices/repo.go	86.95%	3 Missing ⚠️
internal/usecase/devices/redirection.go	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1281      +/-   ##
==========================================
+ Coverage   60.73%   60.88%   +0.14%     
==========================================
  Files         151      151              
  Lines       12632    12682      +50     
==========================================
+ Hits         7672     7721      +49     
- Misses       4959     4960       +1     
  Partials        1        1              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical empty-password fallback failures and incomplete WSMAN path coverage remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 2 · 1

Open (5)

• Handle empty stored passwords before applying Vault fallback · New
• Skip empty password decryption before Vault fallback · New
• Add Vault credential fallback to AMT explorer · New
• Share Vault credential resolver with redirector · New
• Add repeat-POST upsert coverage to Postman collection · New

What changed in this PR

This PR adds duplicate-device POST upserts and Vault-backed credential fallbacks for device operations.

Changes:

• Merges duplicate GUID submissions and returns HTTP 200.
• Adds Vault lookups for MPS_PASSWORD and AMT_PASSWORD.
• Updates wiring, tests, and OpenAPI documentation.

File	Summary
internal/​usecase/​usecase.go	Wires shared certificate storage. Moderate (1 vote): Vault fallback is not shared with all WSMAN paths. Moderate (2 votes): AMT Explorer lacks the fallback. Moderate (2 votes): Redirector lacks the fallback.
internal/​usecase/​devices/​wsman/​message.go	Adds AMT credential lookup. Critical (2 votes): Empty stored passwords fail decryption before the Vault fallback. Critical (2 votes): Empty-password handling must allow AMT_PASSWORD resolution.
internal/​usecase/​devices/​usecase.go	Stores shared Vault/certificate access in the devices use case.
internal/​usecase/​devices/​repo.go	Adds MPS fallback. Moderate (1 vote): Unrelated updates can persist Vault-only passwords and prevent future rotation. Critical (2 votes): Empty AMT passwords can fail duplicate upserts before the WSMAN fallback.
internal/​usecase/​devices/​repo_test.go	Adds coverage for Vault-backed MPS retrieval.
internal/​controller/​openapi/​devices.go	Documents the HTTP 200 upsert response. Nit (2 votes): The checked-in Postman collection lacks repeat-POST and 200-response coverage.
internal/​controller/​httpapi/​v1/​devices.go	Implements duplicate POST upserts. Nit (1 vote): The Postman collection still lacks duplicate-POST coverage while retaining 201 assertions.
internal/​controller/​httpapi/​v1/​devices_test.go	Adds upsert and error-path tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical credential consistency and Vault source-of-truth issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2

Open (2)

• Resolve Vault credentials once for WSMAN and redirection challenge · New
• Prevent Vault fallback credentials from being persisted to the database · New

Resolved since last review (5)

• Skip empty password decryption before Vault fallback
• Handle empty stored passwords before applying Vault fallback
• Share Vault credential resolver with redirector
• Add Vault credential fallback to AMT explorer
• Add repeat-POST upsert coverage to Postman collection

[Copilot]

Copilot review overview

🟡 Changes recommended

Two unresolved findings remain: a critical WSMAN worker-blocking Vault lookup and a moderate persistence race.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Blocking Vault lookup stalls the serialized WSMAN worker · New

Resolved since last review (2)

• Prevent Vault fallback credentials from being persisted to the database
• Resolve Vault credentials once for WSMAN and redirection challenge

Files not reviewed (1)

• internal/mocks/devicemanagement_mocks.go: Generated file

[amarnath-ac]

created separated PR for upsert (##1283) and vault (##1284).