Add secrets module: Spring Cloud Vault, AWS Secrets Manager, Kubernetes configtree and Jasypt on Spring Boot 4.1.2, with real transcripts

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_017ic4b6tTs7ivgTNq4ZrurU

secrets/vault/app-read.hcl

@@ -0,0 +1,8 @@
+# Least privilege for the application's own token: read two KV v2 paths, nothing else.
+# KV v2 inserts "data/" into the API path, so the policy path is secret/data/<name>, not secret/<name>.
+path "secret/data/secrets-demo" {
+  capabilities = ["read"]
+}
+path "secret/data/application" {
+  capabilities = ["read"]
+}