#314 Unify App Secrets and Tenant Secrets into Single System

## Problem Two separate secrets systems exist with different Vault paths: - App secrets: highway/apps/{tenant_id}/{app_name}/ - Tenant secrets: highway/tenants/{tenant_id}/ This causes confusion and prevents workflows from accessing app secrets. ## Solution Consolidate both to use: highway/tenants/{tenant_id}/secrets/{scope}/{name} Where scope = apps/{app_name} | workflows | shared ## Acceptance Criteria - Single Vault path structure for all secrets - Backwards compatibility migration - Workflow tools can access all secret types