design-15 S6a: secret:// operator targets + Sub-Store auto-sync

[lr00rl]

Summary

design-15 §7 server slice (Sub-Store stays a separate companion):

• secret:// operator targets: a declared payload operator-target field may carry secret://<key>; the gateway resolves it from the plugin's own encrypted vault (pluginsecret:<pluginID>) before binding and rewrites the payload, so a saved Sub-Store endpoint backs http.operator.do without the URL re-crossing the browser. Unknown/malformed refs fail loud; resolution is audited without the value.
• Vault isolation preserved: the new pluginSecretValue in plugin_host.go is the single non-broker read path — TestNoHTTPHandlerReachesThePluginSecretStore still confines store accessors to that file.
• Auto-sync: every committed vpn-core mutation (CRUD/bind/unbind/rotate + applied line-user tasks) re-arms a 30s debounced trigger; on fire, if the companion has a saved endpoint and autosync=1, the server invokes import as the system actor (allow/deny audited). Silent skip when disabled/inactive; no generic event bus (design-15 appendix C).

Stacked on #15. Companion artifact/UI slice lands in the sub-store repo.

Verification

• gofmt/go vet clean; go test ./internal/server/ ok (20s) incl. the vault-isolation guard
• New tests: secret:// resolve/rewrite/passthrough/missing/malformed/cross-namespace, autosync gate matrix, invoke-once with bound endpoint, inactive skip, failure → deny audit

Refs LatticeNet/lattice#2, #13–#15.

[lr00rl]

Superseded by #20, which rebased the complete remaining Design 15 stack onto alpha/v0.2.2 and passed go test, go vet, gosec, govulncheck, formatting, and Docker contract CI before merge as 86422a1.