refactor(runtime): prefer env-backed secrets at runtime

docs/security-architecture.md

@@ -62,7 +62,9 @@ publicProcedure
 
 - Passwords: Argon2id hash (never stored in plaintext)
 - TOTP secrets: stored in DB (encrypted at-rest via PostgreSQL TDE when available)
-- API keys (Azure OpenAI, Gemini, SMTP): stored in `SystemSettings` table, accessible only to ADMIN role
+- Runtime secrets now resolve env-first for AI, Gemini, SMTP, and anonymization seed values. Database-backed `SystemSettings` values remain transitional compatibility storage, not the preferred production source of truth.
+- Recommended runtime overrides: `OPENAI_API_KEY`, `AZURE_OPENAI_API_KEY`, `AZURE_DALLE_API_KEY`, `GEMINI_API_KEY`, `SMTP_PASSWORD`, `ANONYMIZATION_SEED`
+- Admin settings reads expose only presence flags (`hasApiKey`, `hasSmtpPassword`, `hasGeminiApiKey`) instead of returning secret values to the browser, and those flags also reflect environment-backed runtime overrides
 
 ### Anonymization
 
@@ -102,7 +104,7 @@ publicProcedure
 
 - All OpenAI/Azure/Gemini API calls logged via `loggedAiCall()` wrapper
 - Structured Pino logs: `{ provider, model, promptLength, responseTimeMs }`
-- Failed calls logged at `warn` level with error details
+- Failed calls logged at `warn` level with sanitized diagnostics only, with URL and secret-like tokens redacted before they reach structured logs
 
 ### tRPC Request Logging
 
@@ -136,13 +138,17 @@ Configured in `next.config.ts`:
 - **Pino** structured logging (JSON in production, pretty-print in development)
 - tRPC errors mapped to appropriate HTTP status codes
 - AI API errors translated to human-readable messages via `parseAiError()` / `parseGeminiError()`
+- Admin connection tests for AI/SMTP return sanitized, user-facing diagnostics only; raw upstream details stay in server logs with redaction for URLs, hosts, emails, and secret-like tokens
 - Internal errors never leak stack traces to the client
 
 ## 10. Dependency Security
 
 - **Dependabot** configured for automated dependency updates
-- `pnpm audit` as part of CI pipeline
+- `pnpm audit` runs in the scheduled [nightly-security.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/nightly-security.yml) workflow, and high-signal architecture guardrails run on every PR in [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml)
 - Lockfile integrity verified on install
+- transitive audit hotspots such as `flatted` and `picomatch` are pinned through root `pnpm.overrides` to keep dev-tooling CVEs from drifting back in through nested dependencies
+- runtime workbook parsing and export generation now use `exceljs` boundaries instead of direct `xlsx` usage in application, engine, and web paths
+- `pnpm audit --audit-level=high` is clean as of 2026-03-30; the remaining dependency findings are low/moderate only
 
 ## 11. Network Architecture