#1801 Datastore config should support vault expressions or env var references for tokens

Problem

Datastore config in .swamp.yaml requires literal token values. Vault expressions (${{ vault.get(...) }}) are only resolved in model definitions, not at the datastore layer. This means any token-based datastore (gitlab-datastore, or anything not using ambient credential chains) forces a plaintext secret into a committed file.

Impact

• .swamp.yaml is committed to git (it holds repo metadata, tool list, version)
• Operators must choose between: committing secrets, gitignoring .swamp.yaml entirely, or using git skip-worktree hacks
• The share guide's vault migration flow doesn't help because the datastore bootstraps before vault resolution
• S3/GCS datastores avoid this by using ambient credential chains, but GitLab/DynamoDB/Postgres with static creds all hit this

Proposed Solution

Support at minimum one of:

1. Environment variable interpolation in datastore config: ${{ env.GITLAB_TOKEN }} or ${GITLAB_TOKEN}
2. Vault expression resolution at the datastore layer (resolve vault before datastore init)
3. A 'credential' field that points to a vault+key pair, resolved specially by the datastore setup

Option 1 is simplest and solves the bootstrap problem without circular dependencies. The token comes from the operator's environment (direnv, shell profile, 1Password CLI, etc.) and .swamp.yaml stays secret-free.

Workaround

Currently using git update-index --skip-worktree on .swamp.yaml and documenting the manual datastore setup step per operator.