Introduce the single Backend interface every credential source implements.
v0 ships two working backends: file (0600 KEY=VALUE env files, parsed in
pure Go, never sourced; looser permission masks refused before read) and
env (process-environment indirection). Bitwarden Secrets Manager and
HashiCorp Vault ship as explicit not-implemented stubs behind the same
interface so the phase-3 connectors are drop-ins. All failures are typed
ResolveErrors carrying only the ref, backend, and a fixed reason enum —
never material.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Purpose kept; adds dated status line, scope/non-goals (no admin UI,
memory-only), today-vs-planned table, and navigable links into the
ukrrs/MOPAC design docs.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
mrcharles