console: put the Secrets settings item + SecretsPanel behind a dev flag — not ready for general release

[mabry1985]

What

The Settings ▸ Secrets item and its SecretsPanel view ship unconditionally today (apps/web/src/settings/SettingsSurface.tsx — the secrets section entry — rendering apps/web/src/settings/SecretsPanel.tsx). The surface isn't ready for general release; gate it behind a developer flag (ADR 0068) so it's visible on the dev channel / via override, hidden otherwise.

How

• Register a secrets-panel flag in runtime/flags.py at the dev tier (mirror an existing registered flag's shape).
• Gate the Settings section entry on useFlag("secrets-panel") (apps/web/src/flags/flags.ts) — the item disappears from the section list when the flag is off, and any direct navigation to the section falls back to the default section rather than rendering the panel.
• No changes to SecretsPanel itself or the underlying API — this is purely visibility gating; the flag's query-param and device-local overrides (ADR 0068 D3) must both work for it.

Acceptance

• Flag off (stable channel default): no Secrets item in Settings; navigating to it directly doesn't render the panel.
• Flag on (dev channel, or ?flag:secrets-panel=on, or the device-local toggle): item + panel exactly as today.
• Frontend unit test for the gating; runtime/flags.py registration covered by whatever pattern existing flags use.
• Full gate green.

[mabry1985]

Shipped in #2121 (merged): secrets-panel flag at dev tier, Settings ▸ Secrets gated via the extracted sectionGate.visibleSections, behavioral + order-insensitive guard tests.