[Secrets Management] Implement proper secrets management (no plaintext secrets)

[OneByJorah]

Secrets Management Gap

Current Issues:

1. Plaintext secrets in .env - All secrets stored unencrypted in .env file
2. No secret rotation - No mechanism for rotating secrets
3. No secret scanning - No truffleHog/git-secrets in CI
4. Secrets in docker-compose - Some defaults have placeholder passwords
5. No external secret store - No HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or SOPS
6. No secret injection at runtime - Secrets baked into images or compose files
7. Camofox API keys in env - No rotation or scoping
8. Honcho token in env - No separate management
9. Database passwords in env - No per-environment separation
10. .env.example has real structure - Could leak config structure

Current Secrets:

• HONCHO_TOKEN - Honcho API auth
• HONCHO_DB_PASSWORD - PostgreSQL password
• POSTGRES_PASSWORD - Duplicate of above?
• CAMOFOX_API_KEY - Browser automation auth
• CAMOFOX_ADMIN_KEY - Browser admin auth
• OBSIDIAN_VAULT_PATH - Path (not secret but config)
• SERVER_IP - Infrastructure info
• LLM API keys (in .env.honcho) - OpenRouter, Venice, etc.

Required Fixes:

• Implement SOPS (Secrets OPerationS) with age/GPG encryption
• Add .sops.yaml config for encryption rules
• Encrypt .env and .env.honcho files
• Add pre-commit hook for secret scanning (truffleHog)
• Add GitHub secret scanning alert
• Implement secret rotation procedure
• Use Docker secrets for runtime injection (swarm mode) or external secret operator
• Separate secrets by environment (dev/staging/prod)
• Add secret audit trail
• Create secrets management runbook