`interpolate_secrets` does not error on a secret the vault cannot resolve:
it substitutes the empty string and returns the name in its second tuple
element. `load_async` discarded that vec, so a typo'd or deleted vault
secret produced `api_key = ""` and an unexplained 401 from Qdrant.
Bail instead, naming the RAG and the missing secrets, matching what global
config loading already does.
Dark-Alex-17
93a934439b