Follows the same pattern already used for JWT_SECRET_KEY: interpolated from a required env var, sourced from a Gitea Actions secret in CI.
Follows the same pattern already used for JWT_SECRET_KEY: interpolated from a required env var, sourced from a Gitea Actions secret in CI.