Add AWS Secrets Manager secret provider

[jimpudar]

Summary

• Added an AWS Secrets Manager-backed secret provider registered from instance .env via ROOTCELL_AWS_SECRETS_MANAGER_PROVIDERS.
• Kept secrets.env provider-qualified references intact, with AWS entries using provider id + secret name.
• Wired multiple AWS provider instances into the normal and integration provider bundles.
• Documented the new registration format in README.md.

Testing

• Added unit coverage for provider config parsing, region resolution, factory registration, and AWS secret reads.
• Added tests for SecretString lookup, ARN rejection, and binary/missing-secret failures.
• Validation passed: typecheck, lint, and unit tests.