Docs: secrets are _FILE names; drop the unread Spotiverse secret

Soul S4: the Bifrost handoff notes, the Bifrost profile and the service
contract still named plaintext secret variables; each now names the _FILE
credential path. .env.example and the Spotiverse profile taught
GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET_FILE, which nothing reads: spotiverse
is not in appSlugs. Both lines are removed rather than adding the slug.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -30,7 +30,6 @@ GC_ACCESS_PROVIDER_YOUTUBE_CLIENT_ID=
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_ID=
 # GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_SECRET_FILE=/absolute/path/to/credential
 
-# GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET_FILE=/absolute/path/to/credential
 GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS=
 # GC_ACCESS_APP_GHOSTLIGHT_SHARED_SECRET_FILE=/absolute/path/to/credential
 GC_ACCESS_APP_GHOSTLIGHT_RUNTIME_IDS=yggdrasil-ghostlight

docs/app-profiles/bifrost.md

@@ -68,10 +68,11 @@ paid membership for the requested tier title, and POSTs a signed
 `RecurringSupportSnapshot` fact to Bifrost's
 `/heimdall/patron-support/events` endpoint.
 
-The outbound fact uses `X-Heimdall-Signature-256` with the shared
-`GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET`. Bifrost verifies that HMAC, resolves
-the Heimdall account id to its local user account, deduplicates by provider
-event id, records the support event, and derives patron points locally.
+The outbound fact uses `X-Heimdall-Signature-256` with the shared secret
+Heimdall reads from `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET_FILE`. Bifrost
+verifies that HMAC, resolves the Heimdall account id to its local user account,
+deduplicates by provider event id, records the support event, and derives
+patron points locally.
 
 This route is a bridge from auth-owned Patreon evidence to Bifrost-owned
 governance meaning. Heimdall still does not own points, votes, tiers, ledger

docs/app-profiles/spotiverse.md

@@ -81,12 +81,11 @@ Heimdall needs:
 ```text
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_ID=...
 GC_ACCESS_PROVIDER_SPOTIFY_CLIENT_SECRET_FILE=/absolute/path/to/spotify-client-secret
-GC_ACCESS_APP_SPOTIVERSE_SHARED_SECRET_FILE=/absolute/path/to/spotiverse-shared-secret
 GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS=https://your-spotiverse-portal.example/auth/heimdall/callback
 ```
 
-Spotiverse needs only the Heimdall base URL, matching app secret, and local
-portal callback/return URLs. The callback URL Spotiverse sends in
+Spotiverse needs only the Heimdall base URL and local portal callback/return
+URLs. The callback URL Spotiverse sends in
 `HEIMDALL_CALLBACK_URL` must exactly match one URL in Heimdall's
 `GC_ACCESS_APP_SPOTIVERSE_BACKEND_CALLBACK_URLS` allowlist unless both services
 are running on the same local host.

docs/service-contract.md

@@ -451,8 +451,9 @@ Purpose:
 Authentication:
 
 - requires `x-heimdall-app-secret`
-- the configured secret comes from `GC_ACCESS_APP_{APP_SLUG}_SHARED_SECRET`,
-  per app; there is no generic fallback secret shared across apps
+- the configured secret comes from the credential file named by
+  `GC_ACCESS_APP_{APP_SLUG}_SHARED_SECRET_FILE`, per app; there is no generic
+  fallback secret shared across apps
 
 Request body:
 

notes/fresh-workspace-handoff.md

@@ -233,9 +233,10 @@ Bifrost needs browser verification after deployment:
 
 - configure Heimdall with
   `GC_ACCESS_APP_BIFROST_BACKEND_CALLBACK_URLS=https://bifrost.gamecult.org/auth/heimdall/callback`
-- configure Heimdall with `GC_ACCESS_APP_BIFROST_SHARED_SECRET`,
+- configure Heimdall with `GC_ACCESS_APP_BIFROST_SHARED_SECRET_FILE`,
   `GC_ACCESS_BIFROST_PATRON_SUPPORT_ENDPOINT=https://bifrost.gamecult.org/heimdall/patron-support/events`,
-  and `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET`
+  and `GC_ACCESS_BIFROST_PATRON_SUPPORT_SECRET_FILE`, each naming a credential
+  file
 - configure Bifrost with `Heimdall__DiscordGuildId`,
   `Heimdall__DiscordAllowedRoleIds__0=<KTLST-role-id>`, and
   `Heimdall__PatreonTierTitle=Inner Sanctum`