docs(*): secrets key in the env example and the secrets page in the readme

README.md

@@ -71,6 +71,12 @@ read-write (it is the dispatcher's home), and `beaver_agent/policy.py` keeps
 it out of `.obsidian`, `мета` outside `мета/бобер`, and from deleting
 anything but its own files.
 
+Keys the agent needs for its own scripts (an RPC key, a service account
+file) go into **System → Secrets** in the admin, not into files in the
+container: they are sealed with `SECRETS_KEY` in Postgres, never shown back,
+and reach a command only through `secret run NAME -- cmd` (see the `secrets`
+skill under `мета/бобер/скиллы/общие/`).
+
 ### 4. Mint a token
 
 Open admin at `http://localhost:62990/` (or `https://<DOMAIN>/` if Caddy), sign in with `ADMIN_USER` / `ADMIN_PASS`, go to **Tokens → Create**, scope `*` for first run.