Mark the OpenAI keys letta and supabase hold as issued outside the mesh

The controller now replaces a given at-start secret after the module's
first good start and on rotate (hq ADR 0228); a key only OpenAI can
issue must say so, or a fresh random value would take its place.

modules/letta/module.json

@@ -34,7 +34,8 @@
     },
     "openai-api-key": {
       "path": "${dir:state}/openai-api-key.secret",
-      "taken": "at-start"
+      "taken": "at-start",
+      "issued-by": "outside"
     }
   },
   "listens": [

modules/supabase/module.json

@@ -44,7 +44,10 @@
     "pooler-vault": "${dir:state}/pooler-vault.secret",
     "key-base-a": "${dir:state}/key-base-a.secret",
     "key-base-b": "${dir:state}/key-base-b.secret",
-    "openai": "${dir:state}/openai.secret"
+    "openai": {
+      "path": "${dir:state}/openai.secret",
+      "issued-by": "outside"
+    }
   },
   "contributes": {
     "route": {