db-credentials, jwt-secret, redis-credentials, s3-credentials. Each service only references the secrets it needs. Values are REPLACE_IN_DEPLOY markers — real values injected by scripts/deploy-secrets.sh. Also updated references in postgres.yaml, migrate.yaml, and postgres-init.yaml to use db-credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>