Secrets

Bitwarden hexis-prod collection inventory: name, type, last-rotated, rotation-due flag. Read-only — rotation runs from the operator laptop via scripts/sync_secrets.sh.