nodered says it reads its API token and admin password at start, so the mesh may rotate them (hq 180)

Both land in settings.js and the runtime's config file, and the containers that read them restart
on those files; a rotation is a new value and a restart. The broker credential says nothing yet: its
other party is the bus, and that rotation is the two-party form.

modules/nodered/module.json

@@ -5,8 +5,14 @@
     "flows.deployed"
   ],
   "own-secrets": {
-    "admin": "${dir:mesh-state}/admin",
+    "admin": {
-    "api-token": "${dir:mesh-state}/api-token",
+      "path": "${dir:mesh-state}/admin",
+      "taken": "at-start"
+    },
+    "api-token": {
+      "path": "${dir:mesh-state}/api-token",
+      "taken": "at-start"
+    },
     "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [