feat: add canonical secret-store contracts

[artiphishle]

Summary

Implements the Contracts release gate for ankhorage/supabase-vault#1 and prepares Studio Phase 2.

• adds provider-neutral SecretStoreAdapter, scope, metadata, payload, result, error, and normalization contracts
• adds the @ankhorage/contracts/secrets public entry point
• adds canonical infra.secretStore.provider manifest support
• adds logical OAuth credentialsRef support without inline credential values
• adds helpers for secret-reference, scope, payload, and forbidden-inline-field validation
• adds focused tests and a minor changeset

Security boundary

The manifest contains only logical references. Raw values, Vault UUIDs, provider credentials, database connection details, and cloud-specific identifiers remain outside public manifest contracts. resolve is explicitly documented as trusted server/deployment-only.

Release ordering

This package must be released before @ankhorage/supabase-vault pins and implements the published interface. Part of ankhorage/supabase-vault#1.