Secrets

Rotate whitelisted .env secrets. Values are masked to the last 4 characters; a change applies only after a restart. The previous value keeps working until you restart, so a typo is recoverable.