#924 Remove Vault: platform secrets from /etc/highway/secrets, tenant secrets AES-GCM in Postgres

EARS SPEC: - The engine shall resolve platform secrets from /etc/highway/secrets (0600) and tenant secrets from Postgres encrypted with existing AES-256-GCM keys. - If a required secret cannot be resolved, then the caller shall fail with an error; no unauthenticated fallback. - Before Vault code is removed, every existing secret shall be exported and a known-positive encrypted row decrypted with the exported key. - The codebase shall not import hvac. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.