feat(mcpd): pluggable SecretBackend abstraction + OpenBao driver + migrate

Why: API keys live in Postgres as plaintext JSON. A DB read exposes every
credential in the system. Before centralising more secrets (LLM keys, etc.)
we want to be able to point at an external KV store and drop DB access to
sensitive rows.

New model:
- `SecretBackend` resource (CRUD + isDefault invariant) owns how a secret is
  stored. `Secret` gains `backendId` FK and `externalRef`. Reads/writes
  dispatch through a driver.
- `plaintext` driver (near-noop, uses existing Secret.data column) is seeded
  as the `default` row at startup. Acts as trust root / bootstrap.
- `openbao` driver (also HashiCorp Vault KV v2 compatible) talks plain HTTP,
  no SDK dependency. Auth via static token pulled from a plaintext-backed
  `Secret` through the injected SecretRefResolver. Caches resolved token.
- `SecretMigrateService` moves secrets one-at-a-time: read → write dest →
  flip row → best-effort source delete. Interrupted runs are idempotent
  (skips secrets already on destination).

CLI surface:
- `mcpctl create|get|describe|delete secretbackend` + `--default` on create.
- `mcpctl migrate secrets --from X --to Y [--names a,b] [--keep-source] [--dry-run]`
- `apply -f` round-trips secretbackends (yaml/json multi-doc + grouped).
- RBAC: `secretbackends` resource + `run:migrate-secrets` operation.
- Fish + bash completions regenerated.

docs/secret-backends.md covers the OpenBao policy, chicken-and-egg auth flow,
and the migration semantics.

Broke the circular dep (OpenBao needs SecretService to resolve its own token,
SecretService needs SecretBackendService) with a deferred-resolver bridge in
mcpd startup. 11 new driver unit tests; existing env-resolver/secret-route/
backup tests updated for the new service signatures. Full suite: 1792/1792.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/db/prisma/schema.prisma

@@ -111,17 +111,48 @@ model McpTemplate {
   @@index([name])
 }
 
+// ── Secret Backends ──
+//
+// Pluggable storage for Secret.data. Default is `plaintext` (data stored in
+// Secret.data JSON). Other drivers (e.g. `openbao`) store only a reference in
+// Secret.externalRef and fetch actual values from the external system at read
+// time. A `plaintext` row is seeded on first startup so the system always has
+// a viable backend; additional backends are user-managed via
+// `mcpctl create secretbackend`.
+
+model SecretBackend {
+  id          String   @id @default(cuid())
+  name        String   @unique
+  type        String                                  // plaintext | openbao | (future: vault, aws-sm, ...)
+  config      Json     @default("{}")                 // type-specific: url, mount, namespace, tokenSecretRef
+  isDefault   Boolean  @default(false)                // exactly one row has isDefault=true
+  description String   @default("")
+  version     Int      @default(1)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  secrets Secret[]
+
+  @@index([name])
+  @@index([isDefault])
+}
+
 // ── Secrets ──
 
 model Secret {
-  id        String   @id @default(cuid())
-  name      String   @unique
-  data      Json     @default("{}")
-  version   Int      @default(1)
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
+  id          String   @id @default(cuid())
+  name        String   @unique
+  backendId   String                                  // FK to SecretBackend — dispatches read/write
+  data        Json     @default("{}")                 // populated by plaintext backend only
+  externalRef String   @default("")                   // populated by non-plaintext backends (e.g. "mount/path#v3")
+  version     Int      @default(1)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  backend SecretBackend @relation(fields: [backendId], references: [id])
 
   @@index([name])
+  @@index([backendId])
 }
 
 // ── Groups ──