#566 Validate vault availability when model has sensitive output fields

Problem

When a model's StateSchema contains fields marked with .meta({ sensitive: true }), swamp currently does not validate whether a vault is available to store those values. If a user creates/syncs a model that returns sensitive data (e.g. privateKeyData from GCP IAM serviceAccounts-keys) and no vault is configured, the operation should fail with a clear error rather than silently storing credentials in plaintext or failing with an opaque error.

Context

Issue #562 adds codegen-level sensitive field detection across all five providers (GCP, AWS, Hetzner, DigitalOcean, Cloudflare). This will mark response fields like privateKeyData, MasterUserPassword, clientSecret, encryptionKey, etc. with .meta({ sensitive: true }) in generated StateSchemas. Without vault validation, users could unknowingly create models that return sensitive data with no vault to protect it.

Proposed Behavior

When a model method writes a state resource that contains sensitive fields:

1. Check if a vault is configured and available
2. If no vault: fail the method with a clear validation error explaining that the model produces sensitive output and a vault must be configured first
3. The error message should name the sensitive fields and link to vault setup docs

This validation should run at method execution time (not model creation time), since the sensitive values are only produced when methods like create, get, or sync run.

Impact

Without this, the sensitive field annotations from #562 are informational only — they redact logs but don't enforce vault-backed storage for the actual data. This validation closes the loop.