[feature] v2: 1Password as a credential provider (service account support) #2274

Use case

I'm planning to use the v2 local CLI as a single MCP gateway for Claude Code, Codex and Hermes. I want to keep connection credentials in 1Password rather than in Executor's own store. On headless machines it needs to work with a 1Password service account (OP_SERVICE_ACCOUNT_TOKEN).

Current state

• v1 (1.6.10) shipped a 1Password provider with desktop-app (biometric) and service-account auth.
• v2 (2.0.0-beta.15): I can't find 1Password in the docs or the build. Credentials go to the OS keychain or keys.json.
• The README still lists plugins/1password, so I'm unsure whether it's planned for v2.

Questions

1. Is the 1Password provider planned for v2, and will it be in the first stable release?
2. Will service-account auth be supported for the CLI and headless use?
3. Can connections reference a 1Password item instead of copying the secret into Executor's store?
4. Are other vaults on the roadmap (Infisical, Bitwarden, Doppler, HashiCorp Vault)?

Interim workaround?

As far as I can tell, supplying EXECUTOR_API_KEY and EXECUTOR_ENCRYPTION_KEY from a secret manager (for example via op run) only protects Executor's own keys, not each connection's credentials. Is there a recommended approach until a provider lands?

Related: #2151 (closed during the backlog clear; asked to re-file against v2)