refactor!: ensure insert/remove not arbitrary

tests/integration/app_secret.bats

@@ -4,6 +4,7 @@ setup_file(){
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _add_server
+  _fetch_recipe
 
   # NOTE(d1): create new app without secrets
   run $ABRA app new "$TEST_RECIPE" \
@@ -195,6 +196,12 @@ teardown(){
   assert_failure
 }
 
+@test "insert: cannot insert unknown secret" {
+  run $ABRA app secret insert "$TEST_APP_DOMAIN" DOESNTEXIST v1 foo
+  assert_failure
+  assert_output --partial 'no secret'
+}
+
 @test "insert: create secret" {
   run $ABRA app secret ls "$TEST_APP_DOMAIN"
   assert_success