feat: resolve quote-token seeds via vault refs

[rickcrawford]

Summary

• Closes WOR-68 by extending secret_ref to accept { secret: "..." } in addition to { env: "..." }.
• Resolves secret: references through sbproxy-vault::SecretResolver with env fallback for OSS/dev parity.
• Reuses the same resolver helper for HTTP ledger HMAC keys and quote-token Ed25519 seeds.

Test plan

• RED: cargo test -p sbproxy-modules quote_token_yaml_resolves_secret_ref_secret_via_env_fallback failed with missing env
• GREEN: cargo test -p sbproxy-modules quote_token_yaml_resolves_secret_ref_secret_via_env_fallback
• cargo test -p sbproxy-modules ledger_yaml_block_resolves_secret_ref_env
• cargo check -p sbproxy-modules
• cargo fmt --all -- --check
• git diff --check
• IDE lints clean for edited files

Made with Cursor