feat(providers): general ?layout=flat setting to resolve at the store root

[ojhermann]

Resolves #181. This started as an Infisical-only ?layout=flat (raised by @nickdichev migrating from BWS); per @domenkozar's suggestion it is now a general provider setting, since the namespaced-vs-root question is the same for every hierarchical backend.

What this adds

?layout=flat maps SecretSpec's {project}/{profile}/{key} convention onto the store root — the secret is addressed by key alone, dropping the secretspec/{project}/{profile} scaffolding but keeping any provider-native container (a Vault mount) or user prefix (an AWS ?prefix=, an Infisical ?path=). The default nested layout is unchanged, so existing configs behave exactly as before.

Honored by Infisical, Vault, AWS Secrets Manager, Google Cloud Secret Manager, and Azure Key Vault. Providers with no hierarchy (dotenv, env, bws) are already flat and ignore it.

[providers]
# Address secrets by key alone at the store root
vault  = "vault://vault.example.com:8200/secret?layout=flat"
awssm  = "awssm://us-east-1?prefix=myteam&layout=flat"   # -> myteam/DATABASE_URL
infisical = "infisical://app.infisical.com/7e2f1a4c-...?layout=flat"

Design

• Parsed once in a shared ProviderUrl::layout() (strict: nested/flat; an unknown value errors, like ?tls=). Each provider's convention_address then honors it in its own dialect. Layout is per-provider-instance, so it works correctly in per-secret fallback chains (a flat provider alongside a nested one).
• Flat addresses by key alone, so project/profile are not validated. Where the backend constrains names, the key must fit: Azure Key Vault uses the key verbatim and refuses an underscore that the nested layout would have Base32-encoded away.
• Profile separation. Dropping the profile means profiles no longer separate by name; a provider that pins its environment another way (an Infisical ?env=) still keeps them apart, but flat plus a pinned env collapses every profile onto one key — a deliberate, documented "you're giving up profile separation" mode.

Still open — your steer, @domenkozar

• Mechanism: a URI query param (this PR) vs. a provider-alias / config field. I lean query-param since providers are URI-configured today (aliases are defined once, so it is set once anyway), but happy to move it.
• Spelling: ?layout=flat / nested.

Tests & docs

Per-provider unit tests (no HTTP mocks): flat addressing, unconstrained project/profile names, key-still-validated, URI round-trip, unknown-layout rejected. Full crate suite green; fmt/clippy clean. Docs updated across the providers reference (a general Layout section) and each provider page, labeled 0.17+.

🤖 Generated with Claude Code