Add BROUTER_AUTH_TOKEN to app secrets (SOPS)

Adds the shared-secret header value consumed by the Planner
(as X-BRouter-Auth outbound) and by the BRouter host's Caddy
sidecar (enforced inbound). Lives in secrets.app.env only;
cd-brouter.yml will also read from this file, making it the
single source of truth. secrets.infra.env is intentionally NOT
updated — cd-infra no longer touches BRouter after the move.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infrastructure/secrets.app.env

@@ -1,24 +1,25 @@
-#ENC[AES256_GCM,data:4AVDH0K+AknlSfn7+uBxY1bQrJaLgu7e4H9a2r0DJTw4cxYMNfDJ4qtcnOAJXQLmf9tdQMQ=,iv:eJ4Cck3LvSi3W58QhZjkmL2+Q+TYYO1w8ucSM9Z2tF0=,tag:OAiQY06xOXDRQqdtTgyVqQ==,type:comment]
-#ENC[AES256_GCM,data:+hScU/d5XG/4YJfrbf7wvQgQxnivPnZiRb43u8WePdmopML3CY0J5A03qpxEJdKYNFcALB/nOd1rMjhjGLexTNjdy+pjPfs+82xlEUU=,iv:azEAINahXBDJeglTu7FSBbd0OvUy5vyiER5aYqDsMfE=,tag:fEwUHGMq5SS5J8NN3auCyw==,type:comment]
-POSTGRES_PASSWORD=ENC[AES256_GCM,data:8GlpWQ8J,iv:P2ZXmY+PIzuRt7IplHIR2Fgqv3v86Js9kadlVLloyv4=,tag:Hnp2UDtrZ6J3zbLO5lydkw==,type:str]
-JWT_SECRET=ENC[AES256_GCM,data:VMN5O225nhWNcjTMXySpGzejCa4Kanat0qN1FjYYGljWkHrgRSOmFEl+lDg=,iv:p+/uFO9tjfuy6dcRkijqvhPDVb9ST90WCSRiFfDJ3aU=,tag:R4dPEwVAe1u9wilvr0e67Q==,type:str]
-SESSION_SECRET=ENC[AES256_GCM,data:sbyyoq+gsVZZbf/YfSAzRN8K1ny+6b4bDoWj5yjJr6qpk7dYoeYKoMGTOek=,iv:Jk81deYxkdyg6MNGMB/DiQRR27cr87CD8K7g70YDzko=,tag:7hAAxEd0DIPZcQ4IgoHrzA==,type:str]
-SMTP_URL=ENC[AES256_GCM,data:o4kgOpqNnbtoAfZMM3+cnk0pHIQ/xfQ7Z2wg003qkx+7aU0JdNW8FXlxPc7QAOHT/jreIirLe9VV6K5tLMA6ICuQeA==,iv:6o06J4DR5IWdNSY9fCBZGRhE6qWnDQR/Dq9HhO4viqA=,tag:gFQs4no1VGTZSzYDfgZeCw==,type:str]
-SMTP_FROM=ENC[AES256_GCM,data:pS4B7UxNc9DIyhveRV0LP3wchAFtCY1TN7NhTK9YsM92,iv:jnz4zEjU++PVC1OOyQTvr4mnDNe1hmx4oqZMLJ/7jcQ=,tag:ifclwnVpmcD8x0SLMK+ZPw==,type:str]
-#ENC[AES256_GCM,data:JBaEnieYaksobMJTGbOYHuzFT1Hx7St/PX6esQUBgtsDCr75VFl0FFRqxdBQwlxhXpGyYKIfAbuECIf0JuMxiild9k/ccVyL6rBTr7TQA6f7P5x9A3SyVb0=,iv:+LT8MMP6bjPcvClofLB36HgIEYhddzJkIaH40cmFNmE=,tag:vQzUpCiA+jID5mWOgZ/c0A==,type:comment]
-SENTRY_AUTH_TOKEN=ENC[AES256_GCM,data:OlNJy9wOTqPxylchz57eFmwk950czwgpQgtYTwjZwBMtDheOGfF/lvqsJiWwxBGNLScKn/f6B8WY2waEBTe+bLEpyPm1RbCS72ov+w+XDJkZoI102zk+/SzeGMT1xsYbYM7o4ClrxsbV1R4/D87mPo2bfd7eBKj1ixy8TaN1zoDM8P+LCsG+KgzA013X964Aybqok0eXlZEU2cWPbHPHUd4+UEhoLPsOUeUWeNkf1QeOjYFYmlThZAQX/sRp0gI=,iv:em12AHHFcCZiUPhV9GX/vLYABb3ydlsRHViRWwqNftw=,tag:9SAqs72gIuPJ5CYZGwcE6Q==,type:str]
-DEPLOY_GHCR_TOKEN=ENC[AES256_GCM,data:cmyUDf24Mt5iS8rRwjpCMPfGBjKDXW4vXQjEqlO1KWNNxO0fW5SFlg==,iv:rhKAgWZ48JGfq2vS6FJ58E9pU41s6zHYe0xo7+YapoM=,tag:LKl86akqu7E32Lp0ScDWYg==,type:str]
-#ENC[AES256_GCM,data:PhxKhxmL30iKEyvTTmmmVZw=,iv:dTLvkB4muDNdBT98EtQdfDnBcpBb7MiBBwDfTkLc2UI=,tag:Qa3jCS4UYHi1kQsXpFwCiw==,type:comment]
-WAHOO_CLIENT_ID=ENC[AES256_GCM,data:RWyd1ocUcIeNk0vIqpb21IAJuIEc6M3g2IC8RmHeOozBpUWppOSB2ItLFg==,iv:CKKy/L9+VZSBEcPoOTEMZa6hWet0qA9kwD+byu2M3WE=,tag:3/qloZMHq3StT0KgtLgxvg==,type:str]
-WAHOO_CLIENT_SECRET=ENC[AES256_GCM,data:1DGPQqjTZVoJmrgXcMav9y3NMe6+FPNvIqSYM1Q6cQDLLkrsGKzFLCYV6w==,iv:aHcjMvQaXln/5R30etnotdV1Yezpdlc2+bqpXT0ab2U=,tag:ZIzvRFecfU9XuetwCPrngQ==,type:str]
-WAHOO_WEBHOOK_TOKEN=ENC[AES256_GCM,data:KQScuqVvDPMyv0rgUC0J225QH3VyL2i3R23PtiC9Ny2ceaD9,iv:jwFRtYLFqlEdbDaJ3WwD+puHMDUpv+8BWPpwnL6iDfQ=,tag:3CxS7Co3p5dfH1JQGpr8FQ==,type:str]
-#ENC[AES256_GCM,data:pVTNdWtliidKyQ==,iv:6SYQ6NTVev9N2vBJpYZ0YI9T7VjNa0s7RBoduapqe7Q=,tag:16aYQ1NHsbNQ+GopI+byQQ==,type:comment]
-DEMO_BOT_ENABLED=ENC[AES256_GCM,data:1DGCKA==,iv:fgN8FofiTbx+BHuPJAuc5NSRqIvltAZXDPhdnqswWhY=,tag:KBcom4hduccHOUtrlNAHwg==,type:str]
-DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:GI0=,iv:AMuQKcpNba+zmUcsD7WCt20yMmUTHSGTOi8P+uXH3Yw=,tag:efgU1u5PBqUqmG20vVuN3Q==,type:str]
-DEMO_BOT_REGION=ENC[AES256_GCM,data:g0vX0lNXRk/ICLkLOr3U3FwpdUIT0tMxn3uHaxsGLc2Qtw==,iv:Cz2jNRBWUEVe9SGh37ZoLdca76Y15riLJowgf9C0cQE=,tag:nwkF4Xi9XX40M2ldGLWE6A==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWblo1Rm9rUlFCQkVVRUVR\nSCtPR1kwMlFvRXplNmdxWVVSOEJzUVB3VlZBCk9Hb1FJSCs1R2llMkk4eGVydnlh\nUmJmU0Joa1pneEZSWFJ5L1VZRnNiZ0UKLS0tIG9aaUkzT0o5dERSekM0cjNxOXBM\nRVhnU1prNjFOa0RQdEVsSlB5QnZzMGcKFFPBeSgQozLR2zohwr/lYBRFzeAK8Hzd\nV635q8YQrXBt9ZUSYvy/b7Gse61+ynaqI7ukLfbc/cRNszQFSuMJyg==\n-----END AGE ENCRYPTED FILE-----\n
+#ENC[AES256_GCM,data:ww5Jcy69nczMA0NXM+TRIbOXEbw1ZbQMY1CfAo/tqRQnRzktO1ZqmCDT2vvlzV3Svjm94F4=,iv:FtrBBmW0z6sR+xm5PDjgxeD8mK0EHP9RubYcBti2AZc=,tag:Eui+7Fhb9RktPp+K22Jwew==,type:comment]
+#ENC[AES256_GCM,data:cUKJRRj7teAMAKSQy5tM1YxYar/3+sEnT7V+jP5sosGEVkGMe2O0jZnBYweYcQA9YGFP7UA/j2zdSi89YYFE7KJCO0ix0gxU0klaktQ=,iv:jiL+AK1PUDHU0eDlcj4dcCXjyFEirQF2fbmsGGXWik4=,tag:dCaIVwSFQSKn+BZp4/iy7A==,type:comment]
+POSTGRES_PASSWORD=ENC[AES256_GCM,data:YWW3SMoY,iv:jxW/S7FL3KryelrEQnbxxwPicbPWaG97W3P1wn0o5QE=,tag:tmuFv4KOpCzVHP6QCBv0ng==,type:str]
+JWT_SECRET=ENC[AES256_GCM,data:dGdP9a5CdapDEU+ZitaS+gYZzQiCCQ/RyhZjIfaX8pReSKTI0/rF2oTOgjM=,iv:5xFU3a0yHqgMKkXKHG7NgnegAILri9cKcg9LkK9SGTQ=,tag:6ZqdmdpS6St8TPiPgddJBg==,type:str]
+SESSION_SECRET=ENC[AES256_GCM,data:kpWkrig2A60lTDWTbnb/mLno7nXjDYrrfQbOmdIsgGcAuceGr7ewPxDuXlw=,iv:R/sDKuVNpi99VNMAyPu5U3a4jbpeVG4os/ZEHkhQ6CU=,tag:Mu1+zBDbveBinFaZCRLjww==,type:str]
+SMTP_URL=ENC[AES256_GCM,data:gVzwdw/qtl0hWWqKDbaD+vYIrrjsewv5Mbey4Vrk++P5JhHsedTncH69roz4plW2gtj/8uIF0LFHteylZukiPwmOZw==,iv:NNxuZ1Rve1xWnWGNS93aBxfh6yr2HZSEAPi7W0gpPlU=,tag:9S27tQrw+HanqQh7POrS/A==,type:str]
+SMTP_FROM=ENC[AES256_GCM,data:M5MaspNeJZEBP+9WH0NYkOUDeuKAz2gGiJtpkzDnfm/1,iv:IgWtsRBgCgJ1BI+H43Fr8m7b8MYcm0Fwo9C2ykPfPeI=,tag:MMLyftnl96Izk129qbRCRg==,type:str]
+#ENC[AES256_GCM,data:AEDUN3ufk7nt7F0l3xnudGuy+ElYGH4zEr93OBVHj/1tm5lefB64sUeg0c3xjAITm1cfHsr7Fggxh/e2woNQP0J0n2W7YgeLTdjc8qu1ESBnuZ3p7GLm3zI=,iv:H+PMzxePmimf3PAopAeUoZngRoU6BbAdTtF9BMUTikg=,tag:63CPdCW6AXpJftxon49swQ==,type:comment]
+SENTRY_AUTH_TOKEN=ENC[AES256_GCM,data:E651MuRZXXrcRsVQbGi48mwOjmkE4zVZb1s3SunW256NOKf53yYcklVobMcXJGt6FiBEYNnF7wTjI+gwMLg8zn3lDhywWvP69h6sABLtnBTNtFGqXn0rHGEqdmkrFHNgQYhuWWb+iyiVPus5xgU71OgToN0HQ5UxiIgmW40k1BDpGWuqCS3Zu1q8IKcwzY41jxQNtanLgA1zPHjfPlXJ9i/68G2frFodtUPr5LsViPvOU/at9OKkSRmw8QfYqVw=,iv:I+tqVWDJDTIlLgf5G71Ak6iZrIihbalfdFgOaqNVGkA=,tag:MLzTa7IFQt1q3+cnmB7VPQ==,type:str]
+DEPLOY_GHCR_TOKEN=ENC[AES256_GCM,data:OlLPbBQHGzB+ipathPb7KQMyA5MdCsxsprynwF2L9Ir5k7IwCfIP5A==,iv:1RNyf+9hVB7pfKCTPndQQkBePqrlcdi7LspcchwRQB4=,tag:ZoNGxbw1dMD9tNfJplajMQ==,type:str]
+#ENC[AES256_GCM,data:NjfDxmmf/3w2s59LLb3HfQk=,iv:bLVAiaUmRtvikb72hFuOpbAkFZn0mtpLCxAfm/0h7kQ=,tag:WaF/lErYjMR9RixuR222Ag==,type:comment]
+WAHOO_CLIENT_ID=ENC[AES256_GCM,data:T7f6/m5F2keZEfBuJZeKrFLayNt4GQfkliallqpChJoLme0IP9sklcYR9A==,iv:kve6y3btWq7LP/F3hIB8I+MgM+9FHHl9+FeEhQ63akM=,tag:47KG+IECcrUMsB5X8HGBmQ==,type:str]
+WAHOO_CLIENT_SECRET=ENC[AES256_GCM,data:/1GtQQT5ul+1UuF3S7xlJ9UjfwKB5ZTrQjqc4yhlIjjlQn0/ATJIZ7c1wg==,iv:GXS0CCX+Qw/w6JrYRMsmypQofelXaCvXo97U4QRXO9w=,tag:bDudhCQ8MZdEHTLp4a4xYA==,type:str]
+WAHOO_WEBHOOK_TOKEN=ENC[AES256_GCM,data:ZWQBNbMbQZunmOTWiwV3TRwDz0S3dHQhLpiJ1JAW/bEF0fqv,iv:qTu74NTv/Q5v7dR9uH8Sv8o1ZEWn2Z6Ng/OB4bhZNLY=,tag:ydkDTAMTyXmZhzJF7zkThw==,type:str]
+#ENC[AES256_GCM,data:/cGixQ9DXEkiJQ==,iv:7rwg4wWQm9FKtnbNaRSdUJW04cnQuZrpKjBmH0fbQDU=,tag:0kDnjhX34sldpCJEctgpCA==,type:comment]
+DEMO_BOT_ENABLED=ENC[AES256_GCM,data:3YjbHg==,iv:S1VkE81GnKfArgKrQkUUIF7ByomzLKXQxvz2NfFN3ts=,tag:cjQIqKLq7nJaBdwVMb9oyg==,type:str]
+DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmLrWRWDuoF7sKXbFg=,tag:UaZ+z+lCcm0HXMMZ3lO9KA==,type:str]
+DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str]
+BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
-sops_lastmodified=2026-04-19T08:33:27Z
-sops_mac=ENC[AES256_GCM,data:OIK/gIKLb8lYMiirw3M+dOAcTPFTArBD/70tv/YDhMZH64J/Boe44JaB2YvrUpT1+Vu9vaoG3JvXw/OcpZd2vKYx57tF9/oJwVgqkpIunS3QPtcYENok9WurNrw526VMk61SUsCMdJx8uTOfUuM/aWzm3AbPWirKdGwYfElWhro=,iv:tvJRe/TDOI4ana+VMQl7frX3m8+IycMpqLnWefFWCZc=,tag:BxqPBItK4JHp+AXQspP50Q==,type:str]
+sops_lastmodified=2026-04-23T20:34:10Z
+sops_mac=ENC[AES256_GCM,data:SgAFlc7VNbH1OJ+RaCEo+TF+vtn2arJOqpZYT6fgSdCPBGRnaI9rqN+paSYYgHQgzrTY7E/iGa/Fmtis8mecwdS+zTNlcF+ucuuo06szb8eq06p0fU49EHE7xUoIPBgwbfKVOc4r2T0iKHJ7iuNVa4UwH6tVeSrQh5tEtAuGikI=,iv:ajzxtZhBXcTDVRwb/A1VaSSUjcoCpE4c3w4SYaHSXBs=,tag:KzMKBaA4TRJQWKWSW04DHg==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.9.4

openspec/changes/relocate-brouter-to-dedicated-host/tasks.md

@@ -19,10 +19,12 @@
 
 ## 2. Secrets and config
 
-- [ ] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
-- [ ] 2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS) and commit the re-encrypted file
-- [ ] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
-- [ ] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`
+- [x] 2.1 Generate a 32-byte random `BROUTER_AUTH_TOKEN`
+  - `openssl rand -base64 32`; active token lives only in SOPS and the operator's clipboard history. Rotate by regenerating and re-running 2.3.
+- [ ] ~~2.2 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.infra.env` (SOPS)~~ **obsoleted** — after relocation, `cd-infra` no longer deploys BRouter and therefore doesn't need the token. `cd-brouter` reads it from `secrets.app.env` instead (see 5.1). Single source of truth.
+- [x] 2.3 Add `BROUTER_AUTH_TOKEN` to `infrastructure/secrets.app.env` (SOPS) for the Planner
+  - Token added via `sops -d | append | sops -e`; round-trip decrypt confirms. Committed in this branch.
+- [ ] 2.4 Add GitHub Actions secrets: `BROUTER_DEPLOY_HOST`, `BROUTER_DEPLOY_SSH_KEY`, `BROUTER_DEPLOY_SSH_PORT`
 - [ ] 2.5 Document the rotation runbook in `docs/deployment.md` (or equivalent)
 
 ## 3. BRouter host compose project