feat: add service secrets vault UI

[rogerchappel]

Summary

• add a super-admin service secrets vault page under dashboard settings
• list masked company secrets and allow create/update (rotate) from the UI
• add a clear entry point from the existing Settings page

Validation

• pnpm typecheck
• pnpm test src/app/api/service-secrets/route.test.ts src/lib/service-secrets.test.ts
• pnpm exec eslint src/app/dashboard/settings/page.tsx src/app/dashboard/settings/service-secrets/page.tsx
• pnpm build