fix(secret-references): resolve dotted local secret names before env.path.key

[jaydeep-pipaliya]

Context

${A.B} was always parsed as a nested reference (env=A, secret=B at root), so a local secret literally named with a dot — e.g. Secret.Reference or any appsettings.json-style transform key that contains dots — could not be referenced from another secret. The Reference Tree UI also broke on these refs (showing "No Value"), because both the runtime expansion and the stack-trace path share the same parser.

The fix is at the expansion layer (recursivelyExpandSecret in backend/src/services/secret-v2-bridge/secret-reference-fns.ts):

1. When a reference has dots, first try fetching a local secret with the full dotted name in the current env/path.
2. If found, use it (this is the user's expected behavior).
3. Otherwise, fall back to the existing env.path.key nested resolution.

This preserves every existing nested reference (cross-env, cross-path) and unblocks dotted local names without changing any storage format. $validateSecretReferences already silently skips references to non-existent envs (backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts:192), so the parser's nested-by-default classification of dotted refs at write time is harmless.

Fixes #5962

Steps to verify the change

1. Create a secret Secret.Reference = test in any env at /.
2. Create a secret Secret_Test = \${Secret.Reference} in the same env at /.
3. Open the Reference Tree for Secret_Test. Expected: resolves to test. Previously: "No Value".
4. Verify existing nested refs still work: \${prod.deep.KEY} from a dev secret should still resolve to the KEY in env prod at /deep.

Type

• Fix

Checklist

• Title follows the conventional commit format
• Tested locally — added 5 unit tests in secret-reference-fns.test.ts:
  • existing nested ref parsing (\${prod.deep.nested.KEY}) still classified correctly
  • single-token local ref (\${HELLO}) still local
  • dotted local secret resolves to local value (regression test for Secret References Don't Work when a dot (.) character is in the Secret Name #5962)
  • dotted ref still resolves as nested when no matching local secret exists
  • dotted local wins over coincidental nested match (documents tie-breaking)
• Verified all tests fail on main without the source change
• Updated docs (no public API change; expansion semantics extended in a strictly more-permissive way)
• Updated CLAUDE.md files (no architectural shift)
• Read the contributing guide

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.