Serve node-launcher's hidden prompt, answering sealed to the asker, so a secret typed at the desk is never in the clear (hq ADR 0259 §10)

modules/rofi/README.md

@@ -4,6 +4,12 @@ The launcher as a module (novox/hq ADR 0208, research 026/04 and 05).
 
 - Installs `rofi`, claims the mesh's `node-launcher` seat and serves its verb `menu`. Requires
   `x11-display` on its own machine.
+- **A value nobody sees** (`node-launcher.secret`, novox/hq ADR 0259 §10): a prompt that shows nothing of
+  what is typed (`rofi -dmenu -password`), whose answer is sealed to the key the asker gives before it
+  leaves this process — never in the clear on the bus, in the runtime's log or in a call's record. The
+  controller's `give` asks it to take a module's own secret, such as a bot token, at the desk. It waits at
+  most 25 seconds. On X11 any program of the operator's account can still read the keys as they are typed
+  (ADR 0234's accepted residual risk), so the operator types only into a prompt they started.
 - **The seat's dmenu-compatible command.** It places `~/.local/bin/dmenu`: choices on standard input,
   the chosen one on standard output, exit 1 when nothing was chosen. It runs `rofi -dmenu`, passing
   on dmenu's `-p`, `-l` and `-i` and dropping its look options. A script, a notifier or a clipboard