Function mover_creds_secrets 

pub fn mover_creds_secrets(backend: &Backend, enc: &Encryption) -> Vec<String>

The distinct credential Secret names a mover Job for backend + encryption needs as envFrom: always the encryption-password Secret, plus the backend auth Secret when present and different. Deduped, order-stable (password first). The common single-secret setup (password + keys in one Secret) collapses to one entry. Names-only projection of mover_creds_secret_refs.