feat: convert secret-sources into a plugin (B20)

src/ui/locales/en.json

@@ -611,22 +611,6 @@
     "selectAVaultProfile": "Select a Vault profile...",
     "vaultProfileHint": "Settings come from the shared profile; you'll sign in to Vault via OIDC when you connect. No secrets are stored.",
     "vaultNewProfile": "New profile",
-    "secretRefHint": "You can paste a 1Password reference (op://vault/item/field) instead of the secret; it is fetched from your secret source when connecting.",
-    "secretSourcesManage": "Manage secret sources",
-    "secretSourcesTitle": "Secret sources",
-    "secretSourcesDesc": "External password managers Termix reads secrets from at connect time. Currently 1Password Connect (self-hosted). The access token is stored encrypted with your data key.",
-    "secretSourceNew": "New source",
-    "secretSourceUrlLabel": "Connect server URL",
-    "secretSourceTokenLabel": "Connect access token",
-    "secretSourceTokenKeep": "Leave empty to keep the current token",
-    "secretSourceSharedLabel": "Share with all users (admins only; resolves while you are signed in)",
-    "secretSourceShared": "shared",
-    "secretSourceTest": "Test",
-    "secretSourceTestOk": "Connected — {{count}} vault(s) visible",
-    "secretSourceTestFailed": "Connection test failed",
-    "secretSourceRequired": "Name, server URL and token are required",
-    "secretSourceSaved": "Secret source saved",
-    "secretSourceDeleted": "Secret source deleted",
     "vaultManageProfiles": "Manage Vault profiles",
     "vaultAddrLabel": "Vault Address",
     "vaultNamespaceLabel": "Namespace",
@@ -2103,9 +2087,6 @@
     "stepCaProvisioner": "OIDC provisioner name",
     "stepCaSaved": "Step CA settings saved",
     "stepCaSaveFailed": "Failed to save Step CA settings",
-    "secretSourcePrivateEndpoints": "Allowed private secret source hosts",
-    "secretSourcePrivateEndpointsDesc": "Private hosts that secret sources (1Password Connect) may contact. Separate them with commas.",
-    "updateSecretSourceEndpointsFailed": "Failed to update the secret source endpoint allowlist",
     "stepCaPrivateEndpoints": "Allowed private Step CA hosts",
     "stepCaPrivateEndpointsDesc": "Private hosts the Step CA certificate flow may contact: the CA itself and, if internal, your identity provider. Separate them with commas.",
     "updateStepCaEndpointsFailed": "Failed to update the Step CA endpoint allowlist",