Keep email runtime configuration out of Vault

infra/local/scripts/secrets.sh

@@ -55,3 +55,16 @@ retire_secrets() (
  # and history are retained until the owner explicitly chooses to destroy them.
  echo 'PASS: Vault secrets migrated and verified; obsolete KV entries retired'
 )
+
+# Only credentials belong in Vault; driver/sender settings are runtime YAML.
+normalize_email_secret() (
+ path=services/notifications/email/resend
+ vault "kv/data/$path" GET yes > "$WORK/email-current"
+ [ "$(cat "$WORK/email-current")" != null ] || exit 0
+ jq -e '(.data.data|keys)-["api_key","driver","sender_address","sender_name"]|length==0' "$WORK/email-current" >/dev/null || fail 'Unexpected Resend secret fields; refusing to discard them'
+ if jq -e '.data.data|keys==["api_key"]' "$WORK/email-current" >/dev/null; then exit 0; fi
+ archive_secret "$path"
+ jq '{data:{api_key:(.data.data.api_key // "")},options:{cas:.data.metadata.version}}' "$WORK/email-current" | vault "kv/data/$path" POST >/dev/null
+ vault "kv/data/$path" | jq -e --slurpfile original "$WORK/email-current" '.data.data|keys==["api_key"] and .api_key==($original[0].data.data.api_key // "")' >/dev/null || fail 'Resend migration verification failed'
+ echo 'Resend secret now contains only api_key; configure driver/sender in notifications runtime.yml'
+)