Health-Check: DNS-over-HTTPS-Rückfall bei nicht auflösbarem Hostnamen, DNS-Problem des Admin-Servers nur Warnung (außer strikte Rollouts); COST_INGEST_KEY optional (Schema-getrieben)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/services/tenants.py

@@ -47,14 +47,18 @@ def create(db: Session, tenant_id: str, name: str, clone_from: str | None, actor
 
 
 def secret_rows(db: Session, tenant_id: str) -> list[dict]:
+    from app.services import contract
+    t = db.get(Tenant, tenant_id)
+    cfg, _ = store.content(db, t, "current") if t else ({}, {})
+    required = [k for k in contract.required_secrets(cfg) if k not in ("CORTECS_API_KEY",)]       # geteilte Secrets stehen unter Einstellungen
     rows = {s.key: s for s in db.scalars(select(Secret).where(Secret.tenant_id == tenant_id))}
-    keys = list(dict.fromkeys(defaults.REQUIRED_SECRETS + [k for k in rows if k not in defaults.REQUIRED_SECRETS]))
+    keys = list(dict.fromkeys(required + [k for k in rows if k not in required]))
     out = []
     for k in keys:
         r = rows.get(k)
         out.append({
             "key": k, "set": bool(r and r.value_enc), "source": r.source if r else "",
-            "required": k in defaults.REQUIRED_SECRETS, "help": defaults.SECRET_HELP.get(k, ""),
+            "required": k in required, "help": defaults.SECRET_HELP.get(k, ""),
             "updated_at": r.updated_at.isoformat() if r and r.updated_at else None,
         })
     return out