Single root key derives all 18 service credentials via HKDF-SHA256.
Bootstrap/service tiers rotate on key change vs every commit.
Provisioners update PostgreSQL roles and Gitea tokens automatically.
CI pipeline runs `api.auth provision` after each deploy.