feat: rename secrets_module → user_state_module and encrypted_secrets_module → user_secrets_module in presets + export pipeline

[pyramation]

Summary

Updates all references to the old module names after the constructive-db renames:

Old name	New name	Renamed in constructive-db
secrets_module	user_state_module	PR #1185
encrypted_secrets_module	user_secrets_module	PR #1196

Module presets (8 files): Updated modules arrays, includes_notes keys, and description text in all presets (minimal, auth:email, auth:email+magic, auth:sso, auth:passkey, auth:hardened, b2b, b2b:storage).

Export pipeline (3 source files): Updated META_TABLE_ORDER, META_TABLE_CONFIG keys/table names, SQL queries in export-meta.ts, and GraphQL query keys in export-graphql-meta.ts.

Tests (2 files): Updated expected module names in export-meta.test.ts and graphql-naming.test.ts.

All 84 tests in pgpm/export pass locally.

Review & Testing Checklist for Human

• Verify constructive-db is deployed with the new table names before any environment uses these updated presets. The provisioner now expects user_state_module / user_secrets_module — passing old names will silently skip provisioning those modules. This is the critical ordering dependency.
• Grep for any remaining references to secrets_module or encrypted_secrets_module outside .ts files (markdown docs, skill references, CI configs, env vars) that this PR may have missed.
• Spot-check the prose description in auth-email.ts (line 29) — now reads "emails, user state, user secrets, sessions" which is accurate but less intuitive than the old wording. Confirm this reads acceptably.

Recommended test plan: Provision a fresh database using one of the updated presets (e.g. auth:email) against a constructive-db instance that has the renamed modules, and verify that user_state_module and user_secrets_module both appear in v_installed.

Notes

• org_secrets_module was already added to the export pipeline in the prior PR (feat: add org_secrets_module to export pipeline #1187, merged). It is not added to any preset here because it is not yet wired into provision_database_modules in constructive-db — it's a standalone module provisioned separately.
• The full preset uses modules: ['all'] so it doesn't list individual module names and needed no changes.

Link to Devin session: https://app.devin.ai/sessions/af039a166f1c4df4a67704c842540835
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring