feat(tamanu): print the config key path for backup defs

[dannash100]

Tamanu 2.60+ encrypts every local_system_secrets value (the settings PSK and so every secret setting, the device key, a facility's sync password) with a per-server key. No backup captures that key today, so a database restored onto another host reads none of them: a clone comes up with its sync user locked out, and a rebuilt host loses its secrets outright.

bestool tamanu config-key-path prints the resolved crypto.keyFile, so a backup def can name it as path_command and capture the key with the database it belongs to.

• Resolves relative paths against the server package dir, as the server does; absolute passes through; no package dir is an error rather than a guess.
• No database needed: server kind comes from the config alone.
• Container installs mount the key as a podman secret and have no path to print; those are covered by backing up podman's secret store instead.

[passcod]

Hmmm I would prefer a special "tamanu secret key" backup method which does the right thing per platform. That way when seedling lands it can start also doing the right thing, and it might be able to be clever enough in future to convert a windows secret to a linux secret to a seedling secret.