feat(keystore,api,ui,docker): encrypted secrets store with a write-only admin page and a secret run helper for the model

src/beaver_gateway/settings.py

@@ -61,6 +61,13 @@ class Settings(BaseSettings):
     """Directories the ``send_file`` tool may read, separated by ``:``. A
     frontend always adds the inbox its own attachments land in."""
 
+    secrets_key: str | None = None
+    """Hex AES-256 key (``openssl rand -hex 32``) sealing the secrets table;
+    unset leaves secrets off. Never reaches the model's environment."""
+
+    secrets_socket: Path = Path("/run/beaver-secrets/gateway.sock")
+    """Root-only socket the ``secret`` helper reads values from."""
+
     bootstrap_tokens: str = ""
     """Out-of-band token seed: ``name1:value1,name2:value2``. Layers
     alongside DB-issued tokens; used for first-run setup and recovery."""