Function backend_auth_secret_ref 

pub fn backend_auth_secret_ref(backend: &Backend) -> Option<&SecretRef>

The backend credentials Secret name for an object-store backend, if any.

Exhaustive over Backend (ADR §5.5): a new backend cannot compile until its credential source is decided here. Object stores read keys (e.g. AWS_ACCESS_KEY_ID) from auth.secretRef; Rclone reads its config from configSecretRef; Filesystem has no backend credentials. This Secret is mounted into the mover Job alongside the encryption-password Secret so kopia can reach the store (the in-process filesystem path never needs it).