feat(secrets): add a 0600 file secret backend so production runs on Linux

The production composition hardwired the macOS Keychain (/usr/bin/security),
which made Linux deployment impossible. Now:

- SecretStore gains a stable provider identity persisted in
  secret_references.provider; services stop hardcoding 'macos-keychain'
- shared reference codec (secret-reference.ts) understands both
  keychain:// and secret-file:// references
- FileSecretStore: single 0600 JSON map under the data root, atomic
  temp+rename writes, serialized in-process, same validation envelope
- production composition picks the backend via
  MULTI_SIMADMIN_SECRET_BACKEND (default: Keychain on darwin, file store
  elsewhere) and readiness probes the matching backend

apps/api/src/control-plane.test.ts

@@ -13,6 +13,7 @@ afterEach(async () => {
   for (const db of dbs.splice(0)) db.close();
 });
 class Store implements SecretStore {
+  readonly provider = 'macos-keychain';
   private readonly values = new Map<string, string>();
   async set(key: { instanceId: string; purpose: string; slot?: string }, value: string) {
     const account = Buffer.from(