docs(secrets): add operator docs for Postgres-backed secrets storage

[chet]

Postgres-backed secrets storage shipped in v2.0 (envelope encryption, configurable read chain, staged Vault migration) with zero operator docs; the design doc (#3225) explains the architecture but not how to run it. One Configuration page makes the feature adoptable.

What this involves

• New page, proposed docs/configuration/secrets-storage.md, in Configuration (Day 1) alongside Machine Identity.
• The [secrets] config surface: backends read order, writer, [secrets.kms] providers (integrated + transit), and [secrets.routing] with its required "/" catch-all.
• The rollout recipe: ["vault"] -> ["postgres", "vault"] + writer = "postgres" -> ["postgres"], plus one-time import_from = "vault" and its idempotency/crash-retry semantics.
• Day-2 operations: nico-admin-cli secrets re-wrap, KEK rotation and retirement via routing, what stale_remaining means.
• Link the design doc for architecture depth once docs(secrets): Add a design doc for Postgres-backed secret storage #3225 merges; add to docs/index.yml.

Satisfies the v2.0 checklist rows for #2665 and #2873. PR #3225 supports this issue but does not close it -- it's the design doc, not operator docs.

Part of #3640.