fix(secret-manager): use remote secret values exactly and check them before a restart

- Write remote secret values as exact dotenv literals in the service .env
  file and escape "$" where they go directly into a generated compose file
  (environment, start commands, healthchecks).
- Resolve remote secrets before a service or database restart stops the
  running resource, and show the secret manager error instead of a generic
  start failure (new RemoteSecretException).
- Cache fetched key names for the autocomplete and rate limit how often a
  user can contact the secret manager.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Exceptions/RemoteSecretException.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+/**
+ * Remote secrets of a resource could not be resolved, for example because the secret manager is
+ * unreachable or a referenced key does not exist. The message names no secret values, so it can be
+ * shown to the user.
+ */
+class RemoteSecretException extends RuntimeException {}