feat: add treatvault block and TreatVault label constants

schema.go

@@ -5,9 +5,17 @@ import "time"
 
 // Config is the typed representation of a Barkfile.
 type Config struct {
-	Listen    string
-	TLS       TLSConfig
-	Databases []DatabaseConfig
+	Listen     string
+	TLS        TLSConfig
+	Databases  []DatabaseConfig
+	TreatVault *TreatVaultConfig
+}
+
+// TreatVaultConfig identifies the encrypted secret source of truth and the
+// bootstrap Docker secret containing its age X25519 identity.
+type TreatVaultConfig struct {
+	File           string
+	IdentitySecret string
 }
 
 // TLSConfig identifies the certificate material used to terminate client TLS.