vars/password-store: replace passBackend option with passPackage

The `clan.core.vars.settings.passBackend` option has been replaced with
`clan.vars.password-store.passPackage` to provide better type safety and
clearer configuration.

Changes:
- Remove problematic mkRemovedOptionModule that caused circular dependency
- Add proper option definition with assertion-based migration
- Users setting the old option get clear migration instructions
- Normal evaluation continues to work for users not using the old option

Migration: Replace `clan.core.vars.settings.passBackend = "passage"`
with `clan.vars.password-store.passPackage = pkgs.passage`

pkgs/clan-cli/default.nix

@@ -2,6 +2,7 @@
   # callPackage args
   gnupg,
   installShellFiles,
+  pass,
   jq,
   lib,
   nix,
@@ -58,6 +59,7 @@ let
 
   testDependencies = testRuntimeDependencies ++ [
     gnupg
+    pass
     stdenv.cc # Compiler used for certain native extensions
     (pythonRuntime.withPackages pyTestDeps)
   ];
@@ -213,6 +215,7 @@ pythonRuntime.pkgs.buildPythonApplication {
                 pkgs.shellcheck-minimal
                 pkgs.mkpasswd
                 pkgs.xkcdpass
+                pkgs.pass
                 nix-select
               ];
             };