Secret-manager references in credentials and request cards #1901

Feature / improvement for Solenta. Priority: Medium. Area: Reliability and credentials.

Extend existing encrypted secrets and thread secret_request cards to a provider such as 1Password. Resolve on use, make references inherently sensitive, show dependencies before provider removal, and provide explicit retry without repeatedly querying a locked vault on unrelated saves. This is reference integration, not a missing secret-card feature.

Acceptance criteria:

• Implement the described behavior using existing shared paths; preserve explicit settings and permissions. Cover the stated edge cases with focused regression checks.
• Run relevant tests/typechecks for any code change, and verify affected UI behavior.

Part of #1869.