feat(secrets): OpenBao-only backend via castle.yaml + per-node prefix

- backend selected by castle.yaml 'secrets:' block (env overrides); no file
  fallback in openbao mode (bootstrap token still read from file)
- route direct-read secrets (public DNS token, supabase pw) through read_secret
- OpenBaoBackend node_prefix: read <prefix>/<name> then shared <name>, so a
  shared vault serves per-node overrides (e.g. each node's postgres password)
- tests updated (fallback removed, settings + node_prefix selection)

core/src/castle_core/stacks.py

@@ -410,11 +410,10 @@ def _substrate_db_url() -> str | None:
     explicit = os.environ.get("SUPABASE_DB_URL")
     if explicit:
         return explicit
-    from castle_core.config import SECRETS_DIR
+    from castle_core.config import read_secret
 
-    pw_file = SECRETS_DIR / "SUPABASE_POSTGRES_PASSWORD"
-    if pw_file.exists():
-        pw = pw_file.read_text().strip()
+    pw = read_secret("SUPABASE_POSTGRES_PASSWORD")
+    if pw:
         port = os.environ.get("SUPABASE_DB_HOST_PORT", "5433")
         return f"postgresql://postgres:{pw}@localhost:{port}/postgres"
     return None