feat(secrets): group-owned, env-scoped secrets + inherited resolution

Migration 0049 reshapes `secrets` to the same polymorphic-owner contract
as `vars` (0048): a secret is owned by an app XOR an ancestor group,
carries an `environment_scope`, and the old PK `(app_id, name)` becomes
two partial-unique indexes `(owner, environment_scope, name)`. Existing
rows backfill to `app_id` + scope `'*'`; the v1 AAD does NOT include the
scope, so every current ciphertext keeps decrypting byte-for-byte.

`SecretsRepo` is generalised to be owner+scope keyed (`SecretOwner` moves
down from `secrets_service` and is re-exported for path stability). The
SDK read path now goes through `SecretsRepo::resolve`, which reuses the
shared `CHAIN_LEVELS_CTE` to walk app→ancestor-group→root, env-filters,
and takes the nearest level (`@E` beating `*` within a level) — returning
the winning owner so the value is decrypted under the AAD it was sealed
with. Runtime injection stays anchored to `cx.app_id`: an app only ever
resolves its own and its ancestors' secrets.

All callers updated to owner+scope (`SecretOwner::App(_)`, scope `'*'`):
the app-secrets admin API, the SDK service, and the apply email-secret
path. The 21 secrets unit tests (incl. the app/group AAD-disjointness and
cross-row swap proofs) stay green; the chain-walk was live-verified
against Postgres (nearest-wins + env-filter). Admin API for group secrets
and the masked-read endpoint land next (Step E).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -818,7 +818,7 @@ impl ApplyService {
     ) -> Result<(Vec<u8>, Vec<u8>), ApplyError> {
         let stored = self
             .secrets
-            .get(app_id, name)
+            .get(crate::secrets_service::SecretOwner::App(app_id), "*", name)
             .await
             .map_err(|e| ApplyError::Backend(e.to_string()))?
             .ok_or_else(|| {
@@ -1018,7 +1018,11 @@ impl ApplyService {
         loop {
             let page = self
                 .secrets
-                .list_names(app_id, cursor.as_deref(), 200)
+                .list_names(
+                    crate::secrets_service::SecretOwner::App(app_id),
+                    cursor.as_deref(),
+                    200,
+                )
                 .await
                 .map_err(|e| ApplyError::Backend(e.to_string()))?;
             names.extend(page.names);