Env Secret Sources

Global admin: where each collector secret that used to live raw in the container env is served from right now (WP-14, docs/secrets-in-vault.md) — in_use vault / env / missing, the DEFAULT tenant's vault name(s) with presence + version, whether the raw env var is still set and whether it equals the vault value (env_removable). NEVER a value. Reads the vault fresh and refreshes the in-process cache, so a just-written secret is in use after this call.