feat(app): Secrets management page + backend-aware API

- new Secrets page (/secrets, nav entry): lists vault secrets, reveal/copy,
  add/edit/delete, shows active backend + addr + role; read-only on followers
- GET /secrets/info (backend/addr/role/writable); fix /secrets CRUD to use the
  castle.yaml-selected backend (was defaulting to the now-empty file backend)
- OpenBaoBackend.list_names drops folder entries (node-prefix groups)
- tests: conftest forces file backend so host castle.yaml can't leak into tests

app builds clean (tsc 0); endpoints verified live against the vault.

app/src/components/Layout.tsx

@@ -7,6 +7,7 @@ import {
   ChevronRight,
   Clock,
   Globe,
+  KeyRound,
   LayoutDashboard,
   Menu,
   Package,
@@ -44,6 +45,7 @@ const NAV: (NavLeaf | NavGroup)[] = [
   { to: "/programs", label: "Programs", icon: Package },
   { to: "/map", label: "System Map", icon: MapIcon },
   { to: "/mesh", label: "Mesh", icon: Share2 },
+  { to: "/secrets", label: "Secrets", icon: KeyRound },
 ]
 
 const COLLAPSE_KEY = "castle-nav-collapsed"