Part of #840. Spec: docs/superpowers/specs/2026-07-02-edgezero-full-migration-design.md §5 Phase 3. Depends on Phase 2 (#842) and edgezero Phase 0 (nested #[secret]).
Derive AppConfig on Settings with #[secret] on real secret fields (incl. nested). Move inline secrets into the secret store; resolve at startup. Delete Redacted<T> and the empty-SECRET_FIELDS wrapper. Provision secrets via ts + publish operator migration guide.
Pre-work: audit Settings secret inventory (settles edgezero B-1: any array secrets?).
Acceptance: pushed blob holds only key names; boot resolves them; nested-secret config validates and serves.
Part of #840. Spec:
docs/superpowers/specs/2026-07-02-edgezero-full-migration-design.md§5 Phase 3. Depends on Phase 2 (#842) and edgezero Phase 0 (nested#[secret]).Derive
AppConfigonSettingswith#[secret]on real secret fields (incl. nested). Move inline secrets into the secret store; resolve at startup. DeleteRedacted<T>and the empty-SECRET_FIELDSwrapper. Provision secrets viats+ publish operator migration guide.Pre-work: audit
Settingssecret inventory (settles edgezero B-1: any array secrets?).Acceptance: pushed blob holds only key names; boot resolves them; nested-secret config validates and serves.