apns credentials belong in the secret store, and cannot go there yet

env is the interim. the secret store's own reasoning applies almost verbatim:
bun auto-loads .env into every pm2 process, so the .p8 is readable from
/proc/<pid>/environ of twenty of them. officer-music has no business being
able to read a key that can push to the owner's apps forever and never
expires.

the obstacle is not a missing purpose string, which is what it looks like from
the outside. getKey(purpose) GENERATES a key and returns it — there is no
setter, because everything in the store so far is something the platform
minted itself. the .p8, the key id, the team id and the fcm service account
all come from outside, so this needs putSecret and a decision about who may
call it. same for DISCORD_WEBHOOK_URL and every plugin credential still in env.

recorded in TODO.md and in the design doc rather than left as an intention.

docs/push-notifications.md

@@ -205,6 +205,17 @@ Env only, on the sidecar, never in the platform process and never in the databas
 
 The `.p8` does not expire and can push to your apps forever. Treat it as spending-grade.
 
+**Env is the interim, not the destination.** These belong in the secret store
+(`src/databases/officer_db/src/secret-store.ts`, built 2026-08-13), and for the reason that store exists:
+bun auto-loads `.env` into every PM2 process, so a key there is readable from `/proc/<pid>/environ` of
+twenty processes — `officer-music` has no business being able to read a credential that can push to your
+apps forever.
+
+It cannot move there yet, and the obstacle is not a missing purpose string. `getKey(purpose)` **generates**
+a key; there is no setter, because every secret in the store so far is one the platform minted itself. The
+`.p8` and the FCM service account come from outside, so holding them needs a `putSecret` first. Tracked in
+`TODO.md`.
+
 `APNS_ENV` appeared in the first design's table and is deliberately **not** implemented: the host is chosen
 per device from the `environment` column, not per process, so one server pushes to a TestFlight build and a
 release build at the same time.