Implement 1Password secret provider CLI operations

[Robertg761]

Related to #6 and #133.

This upgrades secrets-onepassword from log-only stubs to real 1Password CLI-backed secret pull/push behavior.

What changed:

• verify the signed-in account path with op whoami --format json during connect
• implement pull via op item get <item> --vault <vault> --format json
• map 1Password item fields into sh1pt SecretRef[] values with vault/item metadata
• implement push via op item edit <item> --vault <vault> KEY=value ...
• require config.item for pull/push so commands do not silently target a placeholder
• add mocked-CLI tests for pull, push, connect, and missing item behavior

Verified:

• pnpm exec vitest run packages/secrets/onepassword/src/index.test.ts
• pnpm --filter @profullstack/sh1pt-secrets-onepassword typecheck
• pnpm --filter @profullstack/sh1pt typecheck
• git diff --check