feat(secrets): add a 0600 file secret backend so production runs on Linux

The production composition hardwired the macOS Keychain (/usr/bin/security),
which made Linux deployment impossible. Now:

- SecretStore gains a stable provider identity persisted in
  secret_references.provider; services stop hardcoding 'macos-keychain'
- shared reference codec (secret-reference.ts) understands both
  keychain:// and secret-file:// references
- FileSecretStore: single 0600 JSON map under the data root, atomic
  temp+rename writes, serialized in-process, same validation envelope
- production composition picks the backend via
  MULTI_SIMADMIN_SECRET_BACKEND (default: Keychain on darwin, file store
  elsewhere) and readiness probes the matching backend

apps/api/src/interface/http/automation-routes.test.ts

@@ -9,6 +9,7 @@ import type { SecretKey, SecretStore } from '../../infrastructure/secrets/secret
 import { registerAutomationRoutes } from './automation-routes.js';
 
 class MemorySecrets implements SecretStore {
+  readonly provider = 'macos-keychain';
   readonly values = new Map<string, string>();
   async set(key: SecretKey, value: string): Promise<string> {
     const reference = `memory://${key.instanceId}/${key.purpose}`;

apps/api/src/interface/http/central-notification-routes.test.ts

@@ -8,6 +8,7 @@ import type { SecretStore } from '../../infrastructure/secrets/secret-store.js';
 import { registerCentralNotificationRoutes } from './central-notification-routes.js';
 
 class MemorySecrets implements SecretStore {
+  readonly provider = 'macos-keychain';
   readonly values = new Map<string, string>();
 
   async set(key: { instanceId: string; purpose: string }, value: string) {

apps/api/src/interface/http/instance-routes.test.ts

@@ -21,6 +21,7 @@ import type { SecretStore } from '../../infrastructure/secrets/secret-store.js';
 import { registerInstanceRoutes } from './instance-routes.js';
 
 class FakeStore implements SecretStore {
+  readonly provider = 'macos-keychain';
   async set(key: { instanceId: string; purpose: string; slot?: string }) {
     return `keychain://multi-simadmin/${Buffer.from(
       JSON.stringify([key.instanceId, key.purpose, key.slot]),