Migrate Notarius to credential lists

internal/config/credential_projection.go

@@ -50,12 +50,12 @@ func (cfg AuditaConfig) MarshalYAML() (any, error) {
 	}, nil
 }
 
-// MarshalYAML exposes only the public Notarius credential reference name.
+// MarshalYAML exposes only public Notarius credential reference names.
 func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	type safeNotarius struct {
 		Enabled          bool                            `yaml:"enabled"`
 		Binary           string                          `yaml:"binary"`
-		LLMAPIKey        *string                         `yaml:"llm_api_key,omitempty"`
+		Credentials      []string                        `yaml:"credentials,omitempty"`
 		ConfigProfile    *string                         `yaml:"config_profile,omitempty"`
 		Resume           bool                            `yaml:"resume,omitempty"`
 		ChunkCache       string                          `yaml:"chunk_cache,omitempty"`
@@ -67,7 +67,7 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 		Outputs          map[string]NotariusOutputConfig `yaml:"outputs"`
 	}
 	return safeNotarius{
-		Enabled: cfg.Enabled, Binary: cfg.Binary, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
+		Enabled: cfg.Enabled, Binary: cfg.Binary, Credentials: secretReferenceNames(cfg.Credentials),
 		ConfigProfile: cfg.ConfigProfile,
 		Resume:        cfg.Resume, ChunkCache: cfg.ChunkCache,
 		ConfigPath: cfg.ConfigPath, PipelineID: cfg.PipelineID, Timeout: cfg.Timeout,
@@ -75,6 +75,17 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	}, nil
 }
 
+func secretReferenceNames(secrets []configkit.Secret) []string {
+	if secrets == nil {
+		return nil
+	}
+	names := make([]string, len(secrets))
+	for index, secret := range secrets {
+		names[index] = secret.EnvName()
+	}
+	return names
+}
+
 func secretReferenceName(secret *configkit.Secret) *string {
 	if secret == nil {
 		return nil