security: Plaintext secret storage in .env.flatrun files

[nfebe]

Problem

internal/api/server.go (lines 829-861, writeEnvFile) writes database passwords and other secrets to .env.flatrun in plaintext:

os.WriteFile(envFilePath, []byte(content.String()), 0600)

File permissions (0600) are the only protection. Any process running as the same user, or any backup that captures these files, exposes all credentials.

Impact

Credential compromise if the server, a backup, or a file manager is accessed by an attacker.

Proposed Fix

• Encrypt secrets at rest using a master key (e.g., age, SOPS, or a KDF-derived key)
• Decrypt only when injecting into containers at runtime
• Consider Docker secrets or an external secret manager as a longer-term path