fix(security): treat source token_ref as a secret reference, not a raw stored PAT

[pparage]

The deploy path treats source.token_ref as the literal PAT rather than a reference into a secret store. Acknowledged debt: tokens live in the DB/workspace in plaintext. Move to a proper secret reference so raw tokens are not persisted.

[pparage]

Companion: #86 covers the same 'secrets at rest' hardening for the Proxmox API token (ProxmoxHost.token_ref + the v0 group_vars Proxmox creds). This issue (#75) owns the git/Source PAT (Source.token_ref). Same theme, separate subsystems — tracking both, cross-linked.