Per-tenant encrypted secrets vault for Weavric. Exposes secrets to templates as {{ secrets['name'] }} (mirroring the env[...] accessor) behind a pluggable ISecretStore SPI. Ships a default AES-GCM envelope-encrypted JDBC store activated only when JPA is on the classpath; consumers can plug Vault/AWS/etc. Secret values are auto-scrubbed (render as ***) anywhere they are serialized or logged; the real value is only obtainable via an explicit reveal().