Secret management: integrate with Vault, AWS Secrets Manager, GCP Secret Manager

[cl8dep]

Problem

Credentials today come only from environment variables. Enterprise environments manage secrets in dedicated systems (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) and cannot expose them as env vars.

Proposed config syntax

providers:
  cloudflare:
    type: cloudflare
    api_token: vault://secret/dns-sync/cloudflare#api_token
    # or
    api_token: awssm://arn:aws:secretsmanager:us-east-1:123:secret:dns-sync/cf
    # or
    api_token: gcpsm://projects/my-project/secrets/cf-api-token/versions/latest

Secret resolver interface

interface ISecretResolver {
    Task<string> ResolveAsync(string uri, CancellationToken ct);
}

Implementations: VaultSecretResolver, AwsSecretsManagerResolver, GcpSecretManagerResolver, EnvVarResolver (current, default).

Notes

• Secret URIs detected by scheme prefix (vault://, awssm://, gcpsm://)
• Plain strings and ${ENV_VAR} continue to work as today
• Each resolver is an optional dependency — only included if configured