feat: add pass (password-store) provider

[i-am-logger]

Add support for the Unix password manager pass (password-store) as requested in #12.

Features

• Read/write support: Full provider implementation (not read-only)
• Hierarchical storage: One GPG-encrypted file per secret at secretspec/{project}/{profile}/{key}
• Consistent with other providers: Follows the same pattern as keyring, OnePassword, and LastPass
• Migration support: Enables secretspec import dotenv://.env to migrate from plaintext to encrypted storage
• Project/profile namespacing: Properly uses project and profile parameters for organization

Implementation

• Storage path: ~/.password-store/secretspec/{project}/{profile}/{key}.gpg
• Uses pass show secretspec/{project}/{profile}/{key} for reading
• Uses pass insert -e -f secretspec/{project}/{profile}/{key} for writing
• Empty PassConfig (no configuration needed, like KeyringConfig)
• Includes comprehensive tests following existing patterns
• Documentation matches standard provider format

Usage Example

# Initialize pass (first time)
$ pass init <gpg-key-id>

# Import secrets from .env (uses "default" profile)
$ secretspec import dotenv://.env --provider pass --project myapp

# Secrets stored at:
# ~/.password-store/secretspec/myapp/default/DATABASE_URL.gpg
# ~/.password-store/secretspec/myapp/default/API_KEY.gpg

# Run with encrypted secrets
$ secretspec run --provider pass --project myapp -- npm start

Storage Structure

~/.password-store/
└── secretspec/
    └── {project}/
        └── {profile}/
            ├── SECRET_1.gpg
            ├── SECRET_2.gpg
            └── SECRET_3.gpg

Fixes #12

[Copilot]

Pull request overview

This PR adds support for the Unix password manager pass (password-store) as a new secret provider. The implementation follows the dotenv provider pattern, storing all secrets in a single GPG-encrypted entry using KEY=value format to minimize GPG decryption operations.

Key changes:

• Full read/write provider implementation with KEY=value storage format
• Integration tests and provider registration
• Documentation for installation and usage

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
secretspec/src/provider/pass.rs	New pass provider implementation with read/write operations using pass show and pass insert commands
secretspec/src/provider/mod.rs	Module registration for the pass provider
secretspec/src/provider/tests.rs	Integration tests for pass provider creation, URI parsing, and write capability verification
test-pass.toml	Test configuration file (should be relocated to tests/fixtures/)
docs/src/content/docs/providers/pass.md	User documentation covering installation, configuration, and usage examples

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[i-am-logger]

@domenkozar made the change. personally i'm using pass with yubikey, which is why i originally wanted a single gpg file for all secrets (one yubikey touch to decrypt everything vs touching it for every secret). but i understand the consistency argument with other providers. let me know if there's a better way to handle the yubikey touch UX or if we should just keep it as-is for consistency