Add backend resolver interface with file and env backends plus phase-3 stubs

Introduce the single Backend interface every credential source implements.
v0 ships two working backends: file (0600 KEY=VALUE env files, parsed in
pure Go, never sourced; looser permission masks refused before read) and
env (process-environment indirection). Bitwarden Secrets Manager and
HashiCorp Vault ship as explicit not-implemented stubs behind the same
interface so the phase-3 connectors are drop-ins. All failures are typed
ResolveErrors carrying only the ref, backend, and a fixed reason enum —
never material.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

internal/backend/vault.go

@@ -0,0 +1,22 @@
+package backend
+
+import "context"
+
+// Vault is the phase-3 HashiCorp Vault backend (KV v2 + AppRole via the
+// official Go api package, MPL-2.0, vendored). v0 ships the interface
+// slot ONLY: it resolves nothing and returns an explicit
+// not-implemented error naming the ref and backend, so the connector is
+// a drop-in behind the same interface later and misconfigured rollouts
+// fail loudly today.
+type Vault struct{}
+
+// NewVault returns the vault stub.
+func NewVault() *Vault { return &Vault{} }
+
+// Name implements Backend.
+func (v *Vault) Name() string { return "vault" }
+
+// Resolve implements Backend.
+func (v *Vault) Resolve(ctx context.Context, ref Ref) (string, error) {
+	return "", Err(ref, v.Name(), ReasonNotImplemented)
+}