refactor(settings): adopt environment-only runtime secret flow

docs/ci-cd-manual.md

@@ -154,6 +154,11 @@ SMTP_PORT=587
 SMTP_USER=notifications@example.com
 SMTP_PASSWORD=<password>
 SMTP_FROM=CapaKraken <notifications@example.com>
+OPENAI_API_KEY=<optional-if-openai-used>
+AZURE_OPENAI_API_KEY=<optional-if-azure-chat-used>
+AZURE_DALLE_API_KEY=<optional-if-azure-image-gen-used>
+GEMINI_API_KEY=<optional-if-gemini-used>
+ANONYMIZATION_SEED=<required-if-deterministic-anonymization-enabled>
 ```
 
 Generate a secure `NEXTAUTH_SECRET`:
@@ -162,6 +167,12 @@ Generate a secure `NEXTAUTH_SECRET`:
 openssl rand -base64 32
 ```
 
+Runtime secret policy:
+
+- production secrets are injected through the deployment environment or host secret store
+- admin settings must not be used to enter or rotate AI, SMTP, or anonymization secrets
+- the admin UI is only for status checks and cleanup of legacy database-stored secret values
+
 ---
 
 ## 5. Deployment
@@ -169,13 +180,13 @@ openssl rand -base64 32
 ### docker-compose (simplest)
 
 ```bash
-# On your server
+# On your server, after updating the host-side env/secret source
 git pull
 docker compose -f docker-compose.prod.yml up -d --build
 
 # Run database migrations
 docker compose -f docker-compose.prod.yml exec app \
-  pnpm db:push
+  pnpm --filter @capakraken/db db:migrate:deploy
 
 # Seed initial data (first deployment only)
 docker compose -f docker-compose.prod.yml exec app \
@@ -193,6 +204,7 @@ git pull origin main
 pnpm install
 pnpm db:generate
 pnpm db:validate
+pnpm --filter @capakraken/db db:migrate:deploy
 pnpm --filter @capakraken/web exec next build
 rm -rf apps/web/.next/cache  # clear stale cache
 
@@ -203,6 +215,8 @@ PORT=3100 pnpm --filter @capakraken/web start &
 
 Use the repo-level `pnpm db:*` commands for Prisma/database operations. They load `.env`, `.env.local`, `.env.$NODE_ENV`, and `.env.$NODE_ENV.local` automatically before invoking Prisma.
 
+If you rotate runtime secrets during a manual deploy, update the host-side environment source first, then restart the app so the new process reads the updated values. Do not patch those values through admin settings.
+
 ### nginx configuration
 
 The existing nginx reverse proxy should forward to port 3100: