feat: add direct Vault secret resolution for config

[haasonsaas]

Summary

• add vault config section and runtime resolver for vault://<path>#<key> references
• support Vault Kubernetes auth and token auth at startup
• cache per-path secret reads during config load
• add unit tests for kubernetes auth, token auth, env mapping, and address validation
• document Vault usage in example config + chart values/schema + READMEs

Validation

• go test ./...
• make ci-local