[vitramir]

Describes the change implemented in agynio/images#3, agynio/secrets#26, agynio/console-app#146, agynio/terraform-provider-agyn#90 and agynio/api#190.

The docs described two different models

providers.md already said a registry password is "an ordinary Secret referenced by an Image", with a Registry Credential Setup flow to match, and resource-definitions.md already listed secret_id as the Image field. The implementation never got there — it took a plaintext password and created the Secret behind the caller's back — and images-service.md plus the product docs were later written to match the code instead. Neither side flagged the other.

What this reconciles

• images-service.md — the credential is held by reference; the organization constraint on secret_id and why it exists; CountImagesReferencingSecret; a changed credential is read against the repository before it is stored; deleting an image leaves its Secret alone.
• secrets.md — Image.secret_id added to the referential-integrity table, which listed only egress rules and subscriptions.
• authz.md, resource-definitions.md, product/images/images.md, product/console/console.md — brought in line.
• New change doc.

The change doc also records two things found on the way and deliberately left out of scope: the LLM service's ResolveSecretExists check does not compare organizations, and the Secrets service performs no authorization checks in its handlers at all despite secrets.md specifying one per operation.