Keep email runtime configuration out of Vault

docs/implementation.md

@@ -751,3 +751,18 @@ checks read the new path; application identities are denied both paths. Shell
 checks and live infrastructure validation (including Mongo transactions, lease
 renewal/revocation and obsolete-path absence) passed. `make up` still stops at the
 expected missing-Resend check. No backend code or product behavior changed.
+
+Email configuration is now separated from credentials. The current Vault secret
+`kv/services/notifications/email/resend` contains only `api_key`; `driver`,
+`sender_address` and `sender_name` live in
+`infra/local/notifications/runtime.yml`. Sender address is empty until configured.
+Agent injects only `EMAIL_API_KEY`, and notifications loads its runtime YAML
+directly. `make email` prompts only for the API key. The migration preserves the
+key with a CAS-checked update, archives the prior readable version, and refuses
+unknown fields rather than discarding them. The live Vault entry was normalized.
+
+Validation passed: image build, shell/migration tests, live infrastructure checks
+(including key-only secret shape and Mongo transactions/leases), and diff checks.
+`make up` intentionally fails for the still-missing API key. Verified sender must
+also be configured in runtime YAML before rebuilding and starting notifications.
+No backend source changed and no email was sent.