Core abstractions for the secrets manager: the SecretsManager interface, scope model (Server / Organisation / Workspace), placeholder-token reference grammar, and audit / change-event types. No backend implementations live here — those go in sibling secrets-manager-* modules.