feat(core): wire secrets backend config

codex-rs/core/config.schema.json

@@ -881,6 +881,26 @@
       },
       "type": "object"
     },
+    "SecretsBackendKind": {
+      "enum": [
+        "local"
+      ],
+      "type": "string"
+    },
+    "SecretsConfigToml": {
+      "additionalProperties": false,
+      "properties": {
+        "backend": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/SecretsBackendKind"
+            }
+          ],
+          "default": null
+        }
+      },
+      "type": "object"
+    },
     "ShellEnvironmentPolicyInherit": {
       "oneOf": [
         {
@@ -1491,6 +1511,15 @@
       ],
       "description": "Sandbox configuration to apply if `sandbox` is `WorkspaceWrite`."
     },
+    "secrets": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/SecretsConfigToml"
+        }
+      ],
+      "default": null,
+      "description": "Secrets configuration. Defaults to a local encrypted file backend."
+    },
     "shell_environment_policy": {
       "allOf": [
         {