The Decision section described an operator-managed /opt/familienarchiv/.env that CI does not touch. The actual implementation is a two-source model: obs.env (git-tracked, non-secret config) + obs-secrets.env (CI-written fresh from Gitea secrets on every deploy). Also updates the Consequences bullet that incorrectly stated secrets are decoupled from CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>