fix: rename secrets.py → vault.py to avoid shadowing stdlib secrets module

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/beanflows_pipeline/cli.py

@@ -113,7 +113,7 @@ app.add_typer(secrets_app, name="secrets")
 @secrets_app.command("list")
 def secrets_list():
     """List available secrets (keys only)."""
-    from beanflows_pipeline.secrets import list_secrets
+    from beanflows_pipeline.vault import list_secrets
 
     secrets = list_secrets()
     if not secrets:
@@ -130,7 +130,7 @@ def secrets_get(
     key: Annotated[str, typer.Argument(help="Secret key")],
 ):
     """Get a secret value."""
-    from beanflows_pipeline.secrets import get_secret
+    from beanflows_pipeline.vault import get_secret
 
     value = get_secret(key)
     if value is None:
@@ -143,7 +143,7 @@ def secrets_get(
 @secrets_app.command("test")
 def secrets_test():
     """Test sops decryption (verifies sops is installed and age key is present)."""
-    from beanflows_pipeline.secrets import test_connection
+    from beanflows_pipeline.vault import test_connection
 
     typer.echo("Testing SOPS decryption...")
     if test_connection():

src/beanflows_pipeline/providers/hetzner.py

@@ -8,7 +8,7 @@ from hcloud.images import Image
 from hcloud.server_types import ServerType
 
 from beanflows_pipeline.providers import Instance
-from beanflows_pipeline.secrets import get_secret
+from beanflows_pipeline.vault import get_secret
 
 
 def _get_client() -> Client:

src/beanflows_pipeline/workers.py

@@ -1,7 +1,7 @@
 """Worker instance management."""
 
 from beanflows_pipeline.providers import Instance, get_provider
-from beanflows_pipeline.secrets import get_secret
+from beanflows_pipeline.vault import get_secret
 
 DEFAULT_PROVIDER = "hetzner"