Rework secrets management concept page around the new secrets plugins

[djsauble]

NOTE: Do not merge until the plugins have been published to the flox org on FloxHub.

What changed

• New "Secrets plugins" section: first public-docs description of the [plugins.<name>] mechanism (flox 1.14.0+), install flow, and failure policy.
• "Secret retrieval" phase now covers both mechanisms: plugins for supported stores, on-activate hooks for everything else.
• Implementation-example tabs: 1Password and HashiCorp Vault converted from hook examples to [plugins.*] examples; new OpenBao and Infisical tabs (neither store had an example before); Keychain/AWS/cross-platform stay hook-based, now explicitly framed as "no plugin yet".
• Secret store reference table: new "Flox plugin" column; OpenBao and Infisical rows added.
• Rotation warning now mentions that re-attaching to a cached activation replays previously fetched values (fresh activation picks up the new value).
• Softened "They never touch disk" to "never written to the project directory, the manifest, or git" — the activation's transient env snapshots mean the stronger claim isn't strictly true.

Relationship to #49

#49 (draft, "docs: add plugins concept page") also touches this page: it adds a "Packaging this pattern as a plugin" section and a further-reading link to a new /concepts/plugins page. The two PRs are complementary but will conflict textually: if #49 lands first, the "Secrets plugins" section here can slim down to a pointer at /concepts/plugins (the mechanism description moves there), keeping the per-store [plugins.*] example tabs as the meat of this page. This PR deliberately avoids linking /concepts/plugins so it doesn't dangle if it lands first.

Open questions for review (why this is a draft)

1. Distribution wording. flox/flox-plugins is currently org-internal, and the plugin packages aren't published to a public catalog yet. The page links to the repo and shows the build-from-repo flow; adjust once the repo is public or the packages land in the catalog (flox install flox/vault-style).
2. The three plugin PRs on flox-plugins (vault feat: install now appends outputs #10, openbao docs: fix intro, install & quickstart audit findings #11, infisical docs: fix tutorials audit findings #12) are open but unmerged; this page describes them as existing. Resolved 2026-08-06: all three are merged to flox-plugins main (all four plugins retested end-to-end against main-built packages).
3. Is the [plugins] section ready to be publicly documented at all, or should this land together with docs: add plugins concept page #49's concept page and a manifest.toml reference entry?

🤖 Generated with Claude Code

https://claude.ai/code/session_01UEkMUmZaKMzbBy6f4eUypM

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
flox	🟢 Ready	View Preview	Jul 29, 2026, 5:27 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[djsauble]

We haven't done this yet, but the plan is to publish all of the plugins to the flox org on FloxHub, so that users need only run flox install flox/<plugin-package>, no local builds required.

[djsauble]

Addressed in 8f87035, naming corrected in 901cb04 — the section now leads with the planned FloxHub distribution (flox install flox/plugin-vault; published packages use the plugin- prefix) and keeps build-from-repo as the interim path (with a note that store paths pin the build system).