Secrets: load encryption keys and module credentials from AWS Secrets Manager or Google Secret Manager

The keys that protect stored secrets come from plain configuration today: `JWT:Key`, `Secrets:Key` (falling back to `JWT:Key`), `Connectors:Key` and `Mfa:Key`. In practice that means environment variables or an `.env` file on the same machine as the database, so whoever gets the box gets both the ciphertext and the key.

Let a deployment load those values, and module credentials such as `FILES__S3__*` and the ExternalAuth client secrets, from a managed secret store instead.

## Proposal

A module per store, wired in as a configuration source at startup so nothing else in core changes:

- `BarakoCMS.Secrets.Aws` for AWS Secrets Manager
- `BarakoCMS.Secrets.Gcp` for Google Secret Manager

Each maps named secrets onto configuration keys (for example secret `barakocms-jwt-key` onto `JWT:Key`), authenticates with the platform's own identity (instance role on AWS, service account on GCP, never a stored key), and fails startup when a mapped secret cannot be read. Plain configuration keeps working with no module installed, per the rule that a default preserves existing behaviour.

Check the available client and configuration provider packages for each cloud before choosing, and pin them in `Directory.Packages.props`.

## Out of scope

Rotation. Changing `Secrets:Key`, `Connectors:Key` or `Mfa:Key` still makes existing values undecryptable, as SECURITY.md says; loading the key from a vault does not change that.

This is not the answer to #765, which is about which workflow parameters get encrypted at all.

## Cost

Google Secret Manager's free tier covers 6 active secret versions and 10,000 access operations a month. AWS Secrets Manager has no always-free allowance, so the AWS module is for deployments already paying for it.

## Done when

- With the module configured, the app starts with `JWT:Key` absent from the environment and signs tokens with the value from the store.
- A mapped secret that does not exist stops startup with a message naming the secret, not the value.
- Without the module, startup and every existing test are unchanged.

Start by reviewing Directory.Packages.props, the startup configuration path, and SECURITY.md, then investigate client and configuration-provider packages for AWS Secrets Manager and Google Secret Manager. Implement the BarakoCMS.Secrets.Aws and BarakoCMS.Secrets.Gcp modules with platform identity authentication and mapped secrets. Done means missing environment keys can be loaded from either store, missing mapped secrets stop startup without exposing values, and existing behavior and tests remain unchanged without a module.

Written by the indexing model from the issue text.