feat(app): Secrets management page + backend-aware API

- new Secrets page (/secrets, nav entry): lists vault secrets, reveal/copy,
  add/edit/delete, shows active backend + addr + role; read-only on followers
- GET /secrets/info (backend/addr/role/writable); fix /secrets CRUD to use the
  castle.yaml-selected backend (was defaulting to the now-empty file backend)
- OpenBaoBackend.list_names drops folder entries (node-prefix groups)
- tests: conftest forces file backend so host castle.yaml can't leak into tests

app builds clean (tsc 0); endpoints verified live against the vault.

core/src/castle_core/secret_backends.py

@@ -107,7 +107,9 @@ class OpenBaoBackend:
         url = f"{self._addr}/v1/{self._mount}/metadata?list=true"
         try:
             data = self._request("GET", url)
-            return sorted(data.get("data", {}).get("keys", []))
+            keys = data.get("data", {}).get("keys", [])
+            # Drop folder entries (e.g. "nodes/") — those group per-node overrides.
+            return sorted(k for k in keys if not k.endswith("/"))
         except Exception:
             return []