feat(resource): add vm/database/blob binding types; KV now provisioned

Resource binding backend (CRUD + secret-to-KV) is now fully functional after
provisioning the Key Vault. Added vm/database/blob to allowedResourceTypes for
the desktop binding set (gitea/github use type=git + provider). git binding +
KV secret write verified end-to-end (secret lands in heicode-kv).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

heicode/controller/resource.go

@@ -17,7 +17,10 @@ import (
 )
 
 var allowedResourceTypes = map[string]bool{
-	"git":              true,
+	"git":              true, // github / gitea — distinguished by provider
+	"vm":               true, // 虚拟机 (ssh)
+	"database":         true, // 数据库
+	"blob":             true, // 对象存储
 	"sk":               true,
 	"project_document": true,
 	"cloud_account":    true,