Secret-safe BYOK setup

Guide agents through bring-your-own-key flows with masking, no echo, revoke paths, and encrypted-at-rest storage requirements.