Retire Secret

Retire the caller's ACTIVE secret with this alias (Vault step 5, 2026-10-10, owner decisions: the stored value is overwritten at once, the name becomes free, the row stays as value-free history). Storage overwrites the sealed value with a one-byte tombstone (honest retention note: the previous bytes can persist in database history, WAL and backups for their retention period (docs/ops/runbook-erase-user-account.md); they are ciphertext the server cannot open, and no use path can address the row any more), moves the ref to secret:<alias>#retired-<stamp>-<id> (outside the alias charset, so no use path reaches it) and stamps metadata.retired_at. The tenant comes from the VERIFIED claims. 404 when there is no active secret with that alias; a second call is therefore a 404 too. The list and the quota count leave retired secrets out.