fix(secrets): backend-aware token checks; drop stale file-path assumptions

Post-migration sweep of legacy file-based secret code:
- deploy.py + doctor.py checked for the token *file* → false 'secret not found'
  warnings now that tokens live in the vault; use read_secret (backend-aware)
- drop now-unused SECRETS_DIR imports
- refresh stale docstring/prompt text (${secret} 'reads ~/.castle/secrets' →
  'via the active backend'; SecretsEditor add-prompt)

Kept (legitimate file paths): the bootstrap tier (OPENBAO_* token/unseal,
cloudflared creds dir) + the rendered 0600 env files.

core/src/castle_core/config.py

@@ -252,7 +252,7 @@ def resolve_env_split(
     partitioning lets callers keep secrets out of unit files and process argv
     (routing them through a mode-0600 env file) while inlining the rest.
 
-    - ``${secret:NAME}`` reads `~/.castle/secrets/NAME`.
+    - ``${secret:NAME}`` resolves via the active secret backend (file or OpenBao).
     - ``${port}`` / ``${data_dir}`` / ``${name}`` / ``${public_url}`` (and
       anything else in ``context``) expand to castle's computed values, so a
       service maps them to whatever env var its program reads (e.g.

core/src/castle_core/deploy.py

@@ -15,7 +15,6 @@ from dataclasses import dataclass, field
 from pathlib import Path
 
 from castle_core.config import (
-    SECRETS_DIR,
     SPECS_DIR,
     CastleConfig,
     ensure_dirs,
@@ -362,10 +361,12 @@ def _acme_preflight(config: CastleConfig, messages: list[str]) -> None:
             f"Add to services/{_GATEWAY_NAME}.yaml → defaults.env: "
             f"{token_env}: ${{secret:{token_env}}}"
         )
-    if not (SECRETS_DIR / token_env).exists():
+    from castle_core.config import read_secret
+
+    if not read_secret(token_env):
         messages.append(
-            f"Warning: secret '{token_env}' not found in {SECRETS_DIR} — place the "
-            f"DNS-provider API token there (Cloudflare token scope: Zone:DNS:Edit)."
+            f"Warning: secret '{token_env}' is not set in the secret backend — add "
+            f"the DNS-provider API token (Cloudflare token scope: Zone:DNS:Edit)."
         )