Support for external credential stores

As enterprise self-hosters, we have a security requirement to manage secrets through a centralized credential store such as AWS Secrets Manager. This provides centralized access control, audit logging, and rotation capabilities.

Currently, all sensitive configuration is passed via environment variables. We'd like to have support added for optionally fetching secrets from an external credential store.

This would apply to secrets such as:
- `ENCRYPTION_SECRET`
- `SUPERTOKENS_REFRESH_TOKEN_KEY`
- `SUPERTOKENS_ACCESS_TOKEN_KEY`
- etc

### Precedence order

1. Explicit environment variables (highest priority — allows per-service overrides)
2. Values fetched from credential store
3. Defaults defined in zod schemas (lowest priority)