Add castle secret CLI and fail-loud unresolved-secret apply gate

Writing a secret by hand meant knowing the active backend and its layout;
getting it wrong (a file write on an OpenBao fleet) left the value where the
resolver never reads it, so ${secret:NAME} silently degraded to the literal
<MISSING_SECRET:NAME> placeholder that a service then used as its credential.

- `castle secret {list|set|get|rm}` reads/writes the ACTIVE backend, so there's
  no wrong store to pick. `set NAME` with no value reads a hidden prompt / stdin.
- `castle apply` (and --plan) now refuses to converge any deployment whose
  ${secret:...} refs don't resolve in the active backend: exits non-zero, writes
  nothing, and names each deployment + secret + the `castle secret set` fix.
- New helpers in core/config.py: active_secret_backend(), active_backend_name(),
  secret_refs(). Gate impl: deploy._unresolved_secrets() + ApplyResult.blocked.
- Tests: test_deploy_secret_gate.py, TestSecretRefs, test_secret.py. Docs: AGENTS.md.

cli/src/castle_cli/commands/apply.py

@@ -35,6 +35,14 @@ def run_apply(args: argparse.Namespace) -> int:
 
     result = apply(target_name=target, plan=plan)
 
+    # Unresolved secrets abort the run before any change — print the error block
+    # (which names each deployment, the missing ${secret:…}, and the fix) and exit
+    # non-zero so a broken credential never slips through as a bogus placeholder.
+    if result.blocked:
+        for msg in result.messages:
+            print(f"  {_C['deactivate']}{msg}{_C['reset']}")
+        return 1
+
     # Surface any warnings the render produced (acme prerequisites, tunnel notes).
     for msg in result.messages:
         if msg.startswith("Warning"):

cli/src/castle_cli/commands/secret.py

@@ -0,0 +1,93 @@
+"""castle secret — read/write secrets in the *active* backend.
+
+The active backend (file or openbao) is selected by the ``secrets:`` block of
+castle.yaml (env overrides). Writing a secret by hand means knowing that choice
+and the backend's storage layout — get it wrong and the value lands somewhere the
+resolver never reads, so ``${secret:NAME}`` silently degrades to a
+``<MISSING_SECRET:NAME>`` placeholder that a service then uses as if it were the
+real credential (exactly how immich's DB password went to a file on an OpenBao
+fleet). This command routes every read/write through
+:func:`castle_core.config.active_secret_backend`, so there's no wrong store to
+pick. ``castle apply`` refuses to converge a deployment whose secrets don't
+resolve here.
+"""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import sys
+
+from castle_core.config import active_backend_name, active_secret_backend
+
+
+def run_secret(args: argparse.Namespace) -> int:
+    sub = getattr(args, "secret_command", None)
+    if not sub:
+        print("Usage: castle secret {list|set|get|rm}")
+        return 1
+    if sub == "list":
+        return _list()
+    if sub == "set":
+        return _set(args.name, args.value)
+    if sub == "get":
+        return _get(args.name)
+    if sub == "rm":
+        return _rm(args.name, getattr(args, "yes", False))
+    return 1
+
+
+def _list() -> int:
+    backend = active_backend_name()
+    names = active_secret_backend().list_names()
+    if not names:
+        print(f"No secrets in the active '{backend}' backend.")
+        return 0
+    print(f"Secrets in the active '{backend}' backend ({len(names)}):")
+    for n in names:
+        print(f"  {n}")
+    return 0
+
+
+def _set(name: str, value: str | None) -> int:
+    backend = active_backend_name()
+    if value is None:
+        # No value on the argv (keeps it out of shell history / ps). Read from a
+        # hidden prompt when interactive, else from stdin (pipe-friendly).
+        if sys.stdin.isatty():
+            value = getpass.getpass(f"Value for {name}: ")
+        else:
+            value = sys.stdin.read().strip()
+    if not value:
+        print("Error: empty value — refusing to set.", file=sys.stderr)
+        return 1
+    active_secret_backend().write(name, value)
+    print(f"Set '{name}' in the active '{backend}' backend.")
+    return 0
+
+
+def _get(name: str) -> int:
+    value = active_secret_backend().read(name)
+    if value is None:
+        print(
+            f"Secret '{name}' not found in the active '{active_backend_name()}' backend.",
+            file=sys.stderr,
+        )
+        return 1
+    print(value)
+    return 0
+
+
+def _rm(name: str, yes: bool) -> int:
+    backend = active_backend_name()
+    if active_secret_backend().read(name) is None:
+        print(f"Secret '{name}' not found in the active '{backend}' backend.", file=sys.stderr)
+        return 1
+    if not yes:
+        reply = input(f"Delete secret '{name}' from the '{backend}' backend? [y/N] ")
+        if reply.strip().lower() not in ("y", "yes"):
+            print("Aborted.")
+            return 1
+    active_secret_backend().delete(name)
+    print(f"Deleted '{name}' from the active '{backend}' backend.")
+    return 0