feat(app): Secrets management page + backend-aware API

- new Secrets page (/secrets, nav entry): lists vault secrets, reveal/copy,
  add/edit/delete, shows active backend + addr + role; read-only on followers
- GET /secrets/info (backend/addr/role/writable); fix /secrets CRUD to use the
  castle.yaml-selected backend (was defaulting to the now-empty file backend)
- OpenBaoBackend.list_names drops folder entries (node-prefix groups)
- tests: conftest forces file backend so host castle.yaml can't leak into tests

app builds clean (tsc 0); endpoints verified live against the vault.

core/src/castle_core/secret_backends.py

@@ -107,7 +107,9 @@ class OpenBaoBackend:
         url = f"{self._addr}/v1/{self._mount}/metadata?list=true"
         try:
             data = self._request("GET", url)
-            return sorted(data.get("data", {}).get("keys", []))
+            keys = data.get("data", {}).get("keys", [])
+            # Drop folder entries (e.g. "nodes/") — those group per-node overrides.
+            return sorted(k for k in keys if not k.endswith("/"))
         except Exception:
             return []
 

core/tests/conftest.py

@@ -2,9 +2,14 @@
 
 from __future__ import annotations
 
+import os as _os
 from collections.abc import Generator
 from pathlib import Path
 
+# Tests must not read the host's real secret backend (castle.yaml may point
+# at OpenBao); force the file backend unless CI explicitly overrides.
+_os.environ.setdefault("CASTLE_SECRET_BACKEND", "file")
+
 import pytest
 import yaml