feat(notsecrets): migrate sources to IdentitySource trait, add resolve_identities, remove legacy API

- Replace AgeKeySource+retrieve() with IdentitySource+load() returning Box<dyn Identity>
- Rewrite bitwarden/file/prompt sources to implement new trait
- Add resolve_identities() public API with partial-success semantics
- Delete _legacy.rs and remove legacy re-exports from lib.rs
- Update integration tests to use new API

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/notsecrets/src/sources/mod.rs

@@ -1,3 +1,6 @@
+use crate::error::AgeError;
+use crate::identities::Identity;
+
 pub mod bitwarden;
 pub mod file;
 pub mod prompt;
@@ -5,3 +8,10 @@ pub mod prompt;
 pub use bitwarden::BitwardenSource;
 pub use file::FileSource;
 pub use prompt::PromptSource;
+
+/// Infra boundary trait: an identity resolver that loads key material from an
+/// external source and returns a concrete Identity.
+pub trait IdentitySource {
+    fn name(&self) -> &str;
+    fn load(&self) -> Result<Box<dyn Identity>, AgeError>;
+}