The controller reads its credentials from files; every other env-file secret says why

ADR 0086. mesh-controller mounts its six own secrets and names them with
_FILE twins, so no credential of its own reaches its environment. The 35
containers that still read a secret through an env-file carry
secrets-in-environment with the reason; converting each where its software
accepts a path is the per-module work of issue 041.

modules/gitea/module.json

@@ -113,7 +113,8 @@
       ],
       "volumes": [
         "/services/gitea/gitea:/data"
-      ]
+      ],
+      "secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
     },
     {
       "id": "admin-bootstrap",
@@ -137,7 +138,8 @@
         "/bin/sh",
         "-c",
         "su-exec git gitea admin user create --admin --username \"$MESH_GITEA_ADMIN_USER\" --email mesh-admin@localhost --password \"$(cat /run/secrets/admin)\" --must-change-password=false || true"
-      ]
+      ],
+      "secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
     },
     {
       "id": "runtime-config",