Resolve trusted_client_ip.shared_secret through the secret store instead of the app-config blob #1186

Follow-up from ChristianPavilonis's approval review on PR #1049.

trusted_client_ip.shared_secret is the secret value itself and is serialized into the app-config blob. Redacted masks only debug and display output, and the field is not registered for secret-store resolution (it is absent from TrustedServerAppConfig::secret_fields()), so the plaintext secret travels with the config envelope.

Work:

1. Register the field for secret-store resolution so the config carries a key name, matching the other #[secret] fields.
2. Define the compatibility story: accept both the literal and key-name forms during migration, or version the config schema.
3. Migration plan for deployed operators, including ts config push behavior and validation-time strength checks.

Changing this storage contract was out of scope for the documentation refresh; it needs its own compatibility and migration review.