feat: port el-ui vessels — rename crates→vessels, add El source + manifests

ui/vessels/el-secrets/src/lib.rs

@@ -0,0 +1,51 @@
+//! el-secrets — Secrets management for el-ui applications.
+//!
+//! Secrets are NEVER in code. They are:
+//! - `EnvVarSource` — environment variables (`EL_SECRET_JWT_KEY=...`)
+//! - `VaultSource` — HashiCorp Vault (stub, ready for HTTP client integration)
+//! - `AwsSecretsSource` — AWS Secrets Manager (stub)
+//! - `InMemorySource` — for testing only
+//!
+//! All secrets are wrapped in `Secret<T>` which:
+//! - Displays as `[REDACTED]` in all logs and debug output
+//! - Serializes as `"[REDACTED]"` in JSON — never the actual value
+//! - Requires explicit `.expose()` to read
+//!
+//! ## Quick start
+//!
+//! ```
+//! use el_secrets::prelude::*;
+//!
+//! // Load secrets at startup — fails early if anything is missing
+//! let mut src = InMemorySource::new();
+//! src.insert("jwt.key", "test-key-for-testing-only");
+//!
+//! let secrets = SecretsResolver::new()
+//!     .source(Box::new(src))
+//!     .require("jwt.key")
+//!     .resolve()
+//!     .expect("required secrets must be present at startup");
+//!
+//! let jwt_key = secrets.require("jwt.key");
+//! // jwt_key displays as [REDACTED]
+//! // jwt_key.expose() gives the actual value
+//! assert_eq!(jwt_key.expose(), "test-key-for-testing-only");
+//! ```
+
+#![deny(warnings)]
+
+pub mod error;
+pub mod resolver;
+pub mod secret;
+pub mod source;
+
+pub mod prelude {
+    pub use crate::error::SecretsError;
+    pub use crate::resolver::{ResolvedSecrets, SecretsResolver};
+    pub use crate::secret::{Secret, SecretGuard};
+    pub use crate::source::{
+        AwsSecretsSource, EnvVarSource, InMemorySource, SecretsSource, VaultSource,
+    };
+}
+
+pub use prelude::*;