Move AWS, Azure, and 1Password vault providers to extensions

Summary

Move the aws-sm, azure-kv, and 1password vault providers from built-in types to extension vaults, installable via swamp extension pull. This reduces core binary size, makes vault providers independently updatable, and dogfoods the extension vault system.

After migration, only local_encryption (and mock for testing) remain as built-in vault types.

Motivation

• The extension system already fully supports vault extensions (UserVaultLoader, bundleExtension, extension pull)
• Vault providers with external SDK dependencies (AWS, Azure) shouldn't be baked into the core binary
• Makes it easier to add new vault providers without core releases

Plan

Phase 1: Create extension vault packages

Create three extensions publishable to swamp.club:

• @swamp/aws-sm — wraps AwsVaultProvider with Zod configSchema + createProvider
• @swamp/azure-kv — wraps AzureKvVaultProvider
• @swamp/1password — wraps OnePasswordVaultProvider

Each exports a vault object matching the UserVaultSchema expected by UserVaultLoader.

Start with @swamp/1password as proof-of-concept — it only shells out to op CLI (no npm SDK dependencies), so bundling is trivially safe.

Phase 2: Validate SDK bundling

Test that deno bundle correctly inlines @aws-sdk/client-secrets-manager, @azure/identity, and @azure/keyvault-secrets into extension bundles. This is the main technical risk — if bundle size or correctness is an issue, we may need to explore alternatives (e.g. external dependency support in the bundler).

Phase 3: Publish to swamp.club

Push all three extensions to the registry:

swamp extension push @swamp/aws-sm
swamp extension push @swamp/azure-kv
swamp extension push @swamp/1password

Phase 4: Add migration guidance in VaultService

When VaultService.fromRepository() encounters a vault config with a type that's been migrated but the extension isn't installed, surface a clear error:

Vault 'my-aws-vault' uses type 'aws-sm' which is no longer built-in.
Install it with: swamp extension pull @swamp/aws-sm

Update RENAMED_VAULT_TYPES to map old names to new extension names:

const RENAMED_VAULT_TYPES: Record<string, string> = {
  "aws": "@swamp/aws-sm",
  "aws-sm": "@swamp/aws-sm",
  "azure": "@swamp/azure-kv",
  "azure-kv": "@swamp/azure-kv",
  "1password": "@swamp/1password",
};

Important: The migration error must fire after type remapping, checking if the remapped type is registered in the vault type registry.

Phase 5: Remove from core

1. vault_types.ts: Remove aws-sm, azure-kv, 1password from BUILT_IN_VAULT_TYPES
2. vault_service.ts: Remove switch cases, remove provider imports, remove isBuiltIn gate on createProvider path
3. vault_create.ts: Remove --region, --vault-url, --op-vault, --op-account flags and resolveProviderConfig(). Extension vaults use --config <json>
4. Delete aws_vault_provider.ts, azure_kv_vault_provider.ts, onepassword_vault_provider.ts from src/domain/vaults/
5. ensureDefaultVaults(): Remove auto-create-AWS-vault logic or have it suggest pulling the extension

Phase 6: Update RENAMED_VAULT_TYPES and backwards compat

Existing vault configs on disk (.swamp/vault/aws-sm/*.yaml) continue to work via type remapping — users don't need to edit config files, just pull the extension.

UX changes

vault create changes from:

swamp vault create aws-sm my-vault --region us-east-1

to:

swamp vault create @swamp/aws-sm my-vault --config '{"region":"us-east-1"}'

Follow-up: Add optional resolveConfig to VaultTypeInfo so extensions can provide interactive config prompting and preserve the convenience flag UX.

Risks

• SDK bundling: AWS/Azure SDKs may produce large bundles or fail to bundle. Validate in Phase 2 before committing.
• Offline users: Can't pull from registry. They can manually create extension files locally.
• CLI UX regression: --config <json> is less ergonomic than dedicated flags. Mitigated by future resolveConfig support.

Files affected

• src/domain/vaults/vault_types.ts
• src/domain/vaults/vault_service.ts
• src/domain/vaults/vault_type_registry.ts
• src/domain/vaults/aws_vault_provider.ts (delete)
• src/domain/vaults/azure_kv_vault_provider.ts (delete)
• src/domain/vaults/onepassword_vault_provider.ts (delete)
• src/cli/commands/vault_create.ts
• Tests for all of the above