Keep email runtime configuration out of Vault

docs/implementation.md

@@ -751,3 +751,18 @@ checks read the new path; application identities are denied both paths. Shell
 checks and live infrastructure validation (including Mongo transactions, lease
 renewal/revocation and obsolete-path absence) passed. `make up` still stops at the
 expected missing-Resend check. No backend code or product behavior changed.
+
+Email configuration is now separated from credentials. The current Vault secret
+`kv/services/notifications/email/resend` contains only `api_key`; `driver`,
+`sender_address` and `sender_name` live in
+`infra/local/notifications/runtime.yml`. Sender address is empty until configured.
+Agent injects only `EMAIL_API_KEY`, and notifications loads its runtime YAML
+directly. `make email` prompts only for the API key. The migration preserves the
+key with a CAS-checked update, archives the prior readable version, and refuses
+unknown fields rather than discarding them. The live Vault entry was normalized.
+
+Validation passed: image build, shell/migration tests, live infrastructure checks
+(including key-only secret shape and Mongo transactions/leases), and diff checks.
+`make up` intentionally fails for the still-missing API key. Verified sender must
+also be configured in runtime YAML before rebuilding and starting notifications.
+No backend source changed and no email was sent.

docs/local-development.md

@@ -40,7 +40,7 @@ kv/
 │   ├── bff/jwt                         # jwt
 │   └── notifications/
 │       ├── callers/bff                 # token; read by BFF and notifications
-│       └── email/resend                # driver, api_key, sender_address, sender_name
+│       └── email/resend                # api_key only
 └── infrastructure/
     ├── nats/auth                       # token; read by NATS and notifications
     └── mongo/bootstrap                 # local administrator and replica-set bootstrap material
@@ -65,22 +65,37 @@ Open [Vault](http://127.0.0.1:18200) and edit
 
 | Field | Value |
 | --- | --- |
-| `driver` | `resend` |
 | `api_key` | Your Resend API key |
-| `sender_address` | Your verified sender address |
-| `sender_name` | Your display name |
+
+The driver and sender settings belong in `infra/local/notifications/runtime.yml`:
+
+```yaml
+email:
+  driver: resend
+  settings:
+    api_key_env: EMAIL_API_KEY
+    sender_address: "your-verified-sender@example.com"
+    sender_name: "SXCHNGE"
+```
+
+Set your verified address in that file and rebuild. It is intentionally empty by
+default, so notifications cannot start with an unconfigured sender. Vault Agent
+injects only the API key; it does not generate email configuration.
 
 Local administrator login material is in private `.local/dev/admin/init.json`.
 Product containers cannot access it. Alternatively use the hidden terminal prompt:
 
 ```sh
 make email
-make up
+make build && make up
 ```
 
 No placeholder key or delivery fallback is installed. Startup validates presence;
-it does not send an email or validate domain ownership with Resend. Updating email
-settings causes Agent to restart notifications. Existing values survive bootstrap.
+it does not send an email or validate domain ownership with Resend. Updating the
+API key causes Agent to restart notifications. Driver/sender changes require an
+image rebuild. Existing API keys survive bootstrap. Migration removes legacy
+driver/sender fields from the current Vault secret with a version-checked write;
+the preceding version is preserved in Vault history and the private archive.
 
 ## Browser HTTPS and internal connections