[0.5.0][Stretch] Pluggable secrets backends (Vault / AWS Secrets Manager)

[erichare]

Stretch goal (pull in if the quarter allows).

Goal

Real secrets managers behind the existing SecretRef abstraction.

Scope

• Add HashiCorp Vault and/or AWS Secrets Manager resolvers behind the existing secret resolver; config + docs. (The SecretRef abstraction already supports this cleanly.)

Key files

runtimes/typescript/src/auth/resolver.ts (secret resolver), config schema

Depends on: none