feat(secrets): add a 0600 file secret backend so production runs on Linux

The production composition hardwired the macOS Keychain (/usr/bin/security),
which made Linux deployment impossible. Now:

- SecretStore gains a stable provider identity persisted in
  secret_references.provider; services stop hardcoding 'macos-keychain'
- shared reference codec (secret-reference.ts) understands both
  keychain:// and secret-file:// references
- FileSecretStore: single 0600 JSON map under the data root, atomic
  temp+rename writes, serialized in-process, same validation envelope
- production composition picks the backend via
  MULTI_SIMADMIN_SECRET_BACKEND (default: Keychain on darwin, file store
  elsewhere) and readiness probes the matching backend

apps/api/src/application/legacy-import/activate-pending-secret.test.ts

@@ -39,6 +39,7 @@ function pendingDatabase(): Database.Database {
 }
 
 class FakeStore implements SecretStore {
+  readonly provider = 'macos-keychain';
   readonly sets: { key: SecretKey; value: string }[] = [];
   readonly deletes: string[] = [];
   setError?: Error;