Refine secrets page UI per review feedback

- Remove duplicate secret name/key display in table row; show name only
- Replace mode and status badges with plain text (status uses color only)
- Drop provider vault second line from table
- Change 'Owned by Paperclip' reference to 'Owned'
- Gray out GCP and Hashicorp vault sections with 'Coming soon' label
- Replace inner sheet TabsList with PageTabBar for consistent tab style
- Rename 'Rotate' → 'Update value' for managed secrets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/api/secrets.md

@@ -51,6 +51,11 @@ GET /api/companies/{companyId}/secret-providers/health
 Returns provider setup diagnostics, warnings, and local backup guidance. Health
 responses must not include secret values or provider credentials.
 
+For `aws_secrets_manager`, an unready health response names the missing
+non-secret provider environment variables, the AWS SDK default credential source
+expected by the server runtime, and the custody rule that AWS bootstrap
+credentials must not be stored in Paperclip `company_secrets`.
+
 The equivalent CLI check is:
 
 ```sh