Function resolve_config_value 

pub fn resolve_config_value(value: &str, conn: &mut Client) -> Result<String>

Resolve $secret:NAME and ${VAR} patterns in a config value.

• $secret:NAME → decrypt from secrets table
• ${VAR} → environment variable
• ${VAR:-default} → environment variable with default
• plain text → returned unchanged