chore: consolidate platform split checks

src/govoplan_core/security/secrets.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import base64
 import hashlib
 from functools import lru_cache
+from typing import Protocol, runtime_checkable
 
 from cryptography.fernet import Fernet, InvalidToken
 
@@ -17,6 +18,21 @@ class SecretDecryptionError(RuntimeError):
     pass
 
 
+CAPABILITY_SECURITY_SECRET_PROVIDER = "security.secretProvider"
+
+
+@runtime_checkable
+class SecretProvider(Protocol):
+    def store_secret(self, *, scope: str, name: str, value: str) -> str:
+        ...
+
+    def read_secret(self, secret_ref: str) -> str | None:
+        ...
+
+    def delete_secret(self, secret_ref: str) -> None:
+        ...
+
+
 def _normalize_fernet_key(value: str) -> bytes:
     candidate = value.strip().encode("utf-8")
     try: