pub fn resolve_configured_secret(value: &str) -> Result<String, String>Expand description
Resolve a configured secret string (DW-045): literals pass through untouched; well-formed references resolve at CALL time; malformed reference-shaped values fail closed. Every consumer of secret-bearing config fields (snapshot validation, the authn registry build, store seeding) goes through this one entry point so no path can bypass resolution.