feat(secrets): env-var resolution for *_file paths and string fields

[albedosehen]

Operators driving rota.yaml from a secret manager (Doppler, Vault agent, systemd LoadCredentialEncrypted=, plain compose env_file:) no longer have to pre-stage plaintext files on disk.

Two patterns

*_file: paths accept the sentinel env:NAME. When set, rota reads the named env var as the secret value instead of opening a file. Existing real paths keep working unchanged.

namecheap:
  api_key_file: env:NAMECHEAP_API_KEY

Applied to:

• namecheap.api_key_file
• cloudflare.api_token_file
• email password_file
• webhook bearer_token_file
• ACME hmac_key_file
• SurrealDB audit password_file

NOT applied to ACME account_credentials_file because that's a read-write persistent state file, not a secret reference.

String fields get ${VAR} interpolation at config-load time. Multiple refs per string are supported.

namecheap:
  username: ${NAMECHEAP_USERNAME}
  client_ip: ${NAMECHEAP_CLIENT_IP}

Applied via RotaConfig::resolve_env to all operator-set strings: namecheap (username, api_user, client_ip), acme (directory_url, contact_email), surrealdb audit (endpoint, namespace, database, username), alert email (smtp_host, username, from, to[]), alert webhook (url).

Failure mode

Unset referenced variable -> Error::ConfigInvalid at RotaConfig::load. Misconfigured deploys fail loud at boot rather than silently calling Namecheap with an empty key.

Implementation

Lives alongside existing redaction in rota_core::secrets:

• read_secret(path) (sync, used at startup; file reads here are <1KB)
• expand_env(s) (${VAR} interpolation)

RotaConfig::load calls resolve_env after serde_yaml parse so backends see fully-resolved values.

Tests

8 new unit tests in rota-core: file read with trim, env-prefix dispatch, missing-env error, ${} interpolation (single + multiple), passthrough, unterminated-brace error. Total: rota-core 40 / rota-daemon 106 / rota-cli 5, all passing.

Docs

New "Secrets and environment variables" section in book/src/configuration.md showing Doppler, systemd, Vault Agent, and plain compose patterns. rota.example.yaml gains a usage block + alternate namecheap example.

CI verified locally

• cargo fmt --all --check clean
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo test --workspace --locked 151 tests pass