<!--
Thanks for contributing to llm-secrets!

Before opening, please make sure:

  - [ ] `cargo fmt --all -- --check` passes
  - [ ] `cargo clippy --all-targets -- -D warnings` passes
  - [ ] `cargo test --all` passes
  - [ ] One logical change per PR
  - [ ] Commit is signed (see CONTRIBUTING.md)
  - [ ] If this is a non-trivial design decision, an ADR has been added under `docs/adr/`
-->

## What

<!-- One paragraph: what does this PR change? -->

## Why

<!-- What problem does it solve? Link the issue: `Closes #N` -->

## Architectural fit

<!-- Does this reinforce workload identity / architectural enforcement?
     If you're adding a new dependency, justify it in one line. -->

## Testing

<!-- How did you verify this works? Tests added? -->
