refactor(runtime): prefer env-backed secrets at runtime

docs/ai-excellence-due-diligence-roadmap.md

@@ -50,6 +50,7 @@ The previously critical SSE and browser parser coverage issues were addressed du
 2. Secret handling is still application-database centric.
    Evidence: system settings mutate and persist API keys and SMTP credentials in [settings.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/settings.ts).
    Risk: operational secrets remain too coupled to the main app data plane for a gold-standard project.
+   Update: runtime resolution is now env-first for the active secret consumers, but persistence is still transitional and should be reduced further.
 
 3. Least-privilege is materially better documented now, but it still needs long-lived enforcement rather than relying mainly on one hardening batch.
    Evidence: the route audience model is now explicit in [route-access-matrix.md](/home/hartmut/Documents/Copilot/capakraken/docs/route-access-matrix.md) and backed by multiple focused auth tests, but the remaining guarantee still depends on continuing test coverage and architecture guardrails as new routes evolve.
@@ -124,6 +125,7 @@ Goals:
 - Keep hardened spreadsheet parser boundaries under regression coverage.
 - Treat the route access matrix and narrowed auth slices as maintained architecture contracts.
 - Move production secrets out of regular application settings, or add an interim encrypted-secrets layer with clear migration path.
+  Status: in progress. Runtime consumers now prefer environment overrides; the remaining gap is eliminating or encrypting compatibility persistence in the admin settings path.
 
 Definition of done:
 

docs/security-architecture.md

@@ -62,7 +62,9 @@ publicProcedure
 
 - Passwords: Argon2id hash (never stored in plaintext)
 - TOTP secrets: stored in DB (encrypted at-rest via PostgreSQL TDE when available)
-- API keys (Azure OpenAI, Gemini, SMTP): stored in `SystemSettings` table, accessible only to ADMIN role
+- Runtime secrets now resolve env-first for AI, Gemini, SMTP, and anonymization seed values. Database-backed `SystemSettings` values remain transitional compatibility storage, not the preferred production source of truth.
+- Recommended runtime overrides: `OPENAI_API_KEY`, `AZURE_OPENAI_API_KEY`, `AZURE_DALLE_API_KEY`, `GEMINI_API_KEY`, `SMTP_PASSWORD`, `ANONYMIZATION_SEED`
+- Admin settings reads expose only presence flags (`hasApiKey`, `hasSmtpPassword`, `hasGeminiApiKey`) instead of returning secret values to the browser, and those flags also reflect environment-backed runtime overrides
 
 ### Anonymization
 
@@ -102,7 +104,7 @@ publicProcedure
 
 - All OpenAI/Azure/Gemini API calls logged via `loggedAiCall()` wrapper
 - Structured Pino logs: `{ provider, model, promptLength, responseTimeMs }`
-- Failed calls logged at `warn` level with error details
+- Failed calls logged at `warn` level with sanitized diagnostics only, with URL and secret-like tokens redacted before they reach structured logs
 
 ### tRPC Request Logging
 
@@ -136,13 +138,17 @@ Configured in `next.config.ts`:
 - **Pino** structured logging (JSON in production, pretty-print in development)
 - tRPC errors mapped to appropriate HTTP status codes
 - AI API errors translated to human-readable messages via `parseAiError()` / `parseGeminiError()`
+- Admin connection tests for AI/SMTP return sanitized, user-facing diagnostics only; raw upstream details stay in server logs with redaction for URLs, hosts, emails, and secret-like tokens
 - Internal errors never leak stack traces to the client
 
 ## 10. Dependency Security
 
 - **Dependabot** configured for automated dependency updates
-- `pnpm audit` as part of CI pipeline
+- `pnpm audit` runs in the scheduled [nightly-security.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/nightly-security.yml) workflow, and high-signal architecture guardrails run on every PR in [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml)
 - Lockfile integrity verified on install
+- transitive audit hotspots such as `flatted` and `picomatch` are pinned through root `pnpm.overrides` to keep dev-tooling CVEs from drifting back in through nested dependencies
+- runtime workbook parsing and export generation now use `exceljs` boundaries instead of direct `xlsx` usage in application, engine, and web paths
+- `pnpm audit --audit-level=high` is clean as of 2026-03-30; the remaining dependency findings are low/moderate only
 
 ## 11. Network Architecture