feat(notsecrets): migrate sources to IdentitySource trait, add resolve_identities, remove legacy API

- Replace AgeKeySource+retrieve() with IdentitySource+load() returning Box<dyn Identity>
- Rewrite bitwarden/file/prompt sources to implement new trait
- Add resolve_identities() public API with partial-success semantics
- Delete _legacy.rs and remove legacy re-exports from lib.rs
- Update integration tests to use new API

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/notsecrets/tests/integration.rs

@@ -1,39 +1,47 @@
-use notsecrets::{AgeKeySource, FileSource, resolve_age_key};
+use notsecrets::{FileSource, IdentitySource, X25519Identity, resolve_identities};
 use std::fs;
 use tempfile::TempDir;
 
+fn generate_age_key_str() -> String {
+    use rand::rngs::OsRng;
+    use x25519_dalek::StaticSecret;
+    let identity = X25519Identity::from_static_secret(StaticSecret::random_from_rng(OsRng));
+    identity.to_bech32()
+}
+
 #[test]
-fn test_file_source_reads_key() {
+fn test_file_source_loads_valid_key() {
     let dir = TempDir::new().unwrap();
     let key_file = dir.path().join("age.key");
-    fs::write(&key_file, "AGE-SECRET-KEY-1ABCDEF\n").unwrap();
+    let key = generate_age_key_str();
+    fs::write(&key_file, format!("{}\n", key)).unwrap();
 
     let source = FileSource::new(key_file.clone());
-    let result = source.retrieve();
-    assert!(result.is_ok());
-    assert_eq!(result.unwrap().trim(), "AGE-SECRET-KEY-1ABCDEF");
+    let result = source.load();
+    assert!(result.is_ok(), "expected Ok, got: {:?}", result.err());
 }
 
 #[test]
 fn test_file_source_missing_returns_err() {
     let source = FileSource::new("/nonexistent/age.key".into());
-    assert!(source.retrieve().is_err());
+    assert!(source.load().is_err());
 }
 
 #[test]
-fn test_resolve_age_key_uses_file_fallback() {
+fn test_resolve_identities_uses_file_source() {
     let dir = TempDir::new().unwrap();
     let key_file = dir.path().join("age.key");
-    fs::write(&key_file, "AGE-SECRET-KEY-1TEST\n").unwrap();
+    let key = generate_age_key_str();
+    fs::write(&key_file, format!("{}\n", key)).unwrap();
 
-    let sources: Vec<Box<dyn AgeKeySource>> = vec![Box::new(FileSource::new(key_file))];
-    let key = resolve_age_key(sources).unwrap();
-    assert_eq!(key.trim(), "AGE-SECRET-KEY-1TEST");
+    let sources: Vec<Box<dyn IdentitySource>> = vec![Box::new(FileSource::new(key_file))];
+    let ids = resolve_identities(sources).unwrap();
+    assert_eq!(ids.len(), 1);
 }
 
 #[test]
-fn test_resolve_age_key_all_fail_returns_err() {
-    let sources: Vec<Box<dyn AgeKeySource>> =
+fn test_resolve_identities_all_fail_returns_err() {
+    let sources: Vec<Box<dyn IdentitySource>> =
         vec![Box::new(FileSource::new("/nonexistent".into()))];
-    assert!(resolve_age_key(sources).is_err());
+    assert!(resolve_identities(sources).is_err());
 }