Runtime secrets

../../homelab-emergency init-secrets creates these untracked files:

vault_master_key: 32-byte base64 key used only to wrap per-credential data keys.
portal_gateway_hmac: 32-byte base64 key used to authenticate Portal-to-Gateway requests.

Back up both outside this repository. Never store either key in vault.db, Authentik, Docker labels, or the Portal UI.