Secrets

Every token this environment needs: what it is for, the least access it should have, where to make it and where to put it. Rootsight reads each one from there; the dashboard never takes or shows a value.