fix(secrets): restore external delete for non-sync keys on writable Vault

[cursor]

Bug and impact

Deleting an access key backed by a writable (non–read-only) Vault (or other external) storage did not call the backend delete when synchronized was false. The Semaphore row was removed but the secret could remain in the external store—orphaned secrets and misleading UX (“deleted” in UI but still present in Vault).

Root cause

In AccessKeyServiceImpl.Delete, commit 757e9e9c (refactor(secrets): vault sync mechanism) merged the read-only and synchronized cases into if storage.ReadOnly || key.Synchronized, which skipped encryptionService.DeleteSecret for any synchronized flag on writable storage. The intended behavior from the prior fix (52268c02) was: skip external delete for read-only storage, or for synchronized keys (local mirror only)—not skip external delete for writable non-sync keys.

Fix

• Split the condition: skip DeleteSecret only when storage.ReadOnly or when the key is synchronized on a writable backend (local reference removal only).
• Added unit tests: writable + non-sync → DeleteSecret called; writable + synchronized → DeleteSecret skipped.

Validation

• go test ./services/server/... -short
• go vet ./services/server/...