[Secrets] Secrets management with external secret stores

[OneByJorah]

Secrets Management Checklist

• Remove all hardcoded secrets from config.yaml.example
• Add support for external secret stores (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault)
• Add SOPS/age for encrypted secrets in git
• Add secret rotation strategy
• Add secret scanning in CI (gitleaks, trufflehog)
• Document secret management procedures
• Add separate secrets for each environment