Add native secret-store config resolution

[ChristianPavilonis]

Summary

• Store secret references, rather than plaintext values, in pushed Trusted Server app-config blobs.
• Resolve references from platform secret stores only after blob integrity verification at runtime.
• Preserve structural deploy validation while wiring Fastly, Axum, Cloudflare, and Spin.

Changes

File	Change
crates/trusted-server-core/src/config.rs	Annotate secret-bearing config fields with EdgeZero secret metadata and separate deploy/runtime validation.
crates/trusted-server-core/src/secret_resolution.rs	Add recursive resolution for nested objects, arrays, optional fields, and fail-closed errors.
crates/trusted-server-core/src/config_payload.rs / settings.rs	Resolve verified config blobs and sanitize runtime validation errors so secret values are not exposed.
crates/trusted-server-adapter-{fastly,axum,cloudflare,spin}/	Wire native config and secret stores into adapter startup.
crates/trusted-server-integration-tests/	Update fixtures, manifests, and adapter coverage for secret references.
trusted-server.example.toml / .env.example / docs/guide/	Document reference-based configuration and platform setup.
Cargo.toml / Cargo.lock	Pin the EdgeZero dependency revision containing typed secret metadata APIs.

Closes

Closes #684

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run (not applicable; no JS changes)
• JS format: cd crates/trusted-server-js/lib && npm run format (not applicable; no JS changes)
• Docs format: cd docs && npm run format (targeted changed-doc checks pass; full check has unrelated pre-existing failures)
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: cargo test-cloudflare, cargo test-spin, adapter parity tests, Cloudflare/Spin WASM checks and Clippy targets, CLI validation, core tests, targeted docs formatting, and git diff --check.

Checklist

• Changes follow CLAUDE.md conventions
• No unwrap() in production code — use expect("should ...")
• Logging follows project conventions; no direct stdout/stderr logging was added
• New code has tests
• No secrets or credentials committed