feat: integrate profile secret resolver in backup and store flows

[rmanibus]

Summary

• Implement RFC 0011 issue RFC 0011: Integrate secret resolver into backup/store profile resolution #92 by wiring secret-reference resolution into profile store runtime merge paths.
• Use shared resolver logic for both backup profile merge and store-driven global flag construction.
• Enforce precedence with tests: CLI flag override > *_secret > direct field > legacy *_env.

What Changed

• Added shared helper: cmd/cloudstic/profile_secret.go
  • resolveProfileStoreValue(field, direct, secretRef, envName)
  • returns actionable field-scoped errors on bad refs
• Updated backup profile merge path:
  • applyProfileStoreToGlobalFlags now returns errors
  • resolves *_secret values (with legacy env fallback)
  • merge path surfaces contextual errors: profile <name> store <ref>: ...
• Updated store runtime path:
  • globalFlagsFromProfileStore now returns (*globalFlags, error)
  • checkOrInitStore reports credential resolution errors early
• Updated global profile override path in store.go to propagate errors.
• Added precedence and failure tests in:
  • cmd/cloudstic/cmd_backup_profile_test.go
  • cmd/cloudstic/cmd_store_test.go

Validation

• go test ./...
• golangci-lint run ./...

Tracking

• Closes RFC 0011: Integrate secret resolver into backup/store profile resolution #92
• Epic: RFC 0011: Epic / Tracking issue for profile credential storage backends #93
• RFC: rfcs/0011-profile-credential-storage-backends.md

[codecov]

Codecov Report

❌ Patch coverage is 55.69620% with 35 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/cloudstic/cmd_store.go	43.33%	9 Missing and 8 partials ⚠️
cmd/cloudstic/cmd_backup.go	55.55%	8 Missing and 8 partials ⚠️
cmd/cloudstic/store.go	0.00%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!