#739 engine.config.get_secret does not read from Vault despite Vault access

get_secret() only checks SECRET_* env vars and [secrets] INI section. It never reads from Vault even though VAULT_ADDR and VAULT_TOKEN_* are available. The email tool calls config.get_secret('highway/shared/mail', 'highway-mail') which fails because it never queries Vault. Secrets stored in Vault at highway/shared/mail are inaccessible to get_secret(). Need to add Vault KV v2 read as a fallback source in get_secret().