fix(cli): stop pre-filling the secrets the server owns

[maxmad64bis]

⚠️ base-red inherited: #9985

Summary

.env.example ships JWT_SECRET= and API_KEY_SECRET= blank on purpose. The server owns both: ensureSecrets() in src/instrumentation-node.ts restores each one from the durable store — the secrets namespace of the database under DATA_DIR — or generates it and persists it there on first use.

Postinstall filled them in anyway, and that defeated the mechanism. The file it writes lives inside the installed package, so npm i -g replaces it and postinstall writes different values, while ensureSecrets() — which only acts on an empty variable — never gets to restore the real ones. Both secrets rotate silently on every update: dashboard sessions are invalidated, and API-key CRCs stop matching the keys that produced them.

STORAGE_ENCRYPTION_KEY left this same list for this same reason in #1622, when it cost users their encrypted credentials. This does the same for the two that stayed behind. Its comment pointed at bin/omniroute.mjs:ensureStorageEncryptionKey(), a function that exists nowhere in the tree; it now names the real provisioning path.

Related Issues

• Closes # — none open on this.
• Related to [BUG] 3.7.0 install regenerates .env (STORAGE_ENCRYPTION_KEY/JWT_SECRET/API_KEY_SECRET) → all stored credentials become un-decryptable, every chat 401, every OAuth refresh 400 invalid_grant #1622, which removed STORAGE_ENCRYPTION_KEY from the same list.
• Same lineage as fix(docker): empty .env secret placeholders override persisted server.env keys → restart crash loop #6824 and fix(bootstrap): filter empty process.env values to prevent Docker env crash loop #6828: blank placeholders shipped in .env were overriding the keys persisted in {DATA_DIR}/server.env. Those fixed the merge so a blank can't win; this one removes the two placeholders that weren't blank in the first place.

Validation

• Change type: CLI — install-time env sync only
• Focused tests and category gates from the golden path (CLI)
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

$ node --test tests/unit/sync-env.test.ts tests/unit/sync-env-bundled-require-5006.test.ts \
    tests/unit/bootstrap-env.test.ts tests/unit/cli-storage-key-bootstrap.test.ts
# tests 15
# pass 15
# fail 0

$ npm run check:cli-i18n
[cli-i18n] PASS — CLI i18n is consistent

$ npx eslint scripts/dev/sync-env.mjs tests/unit/sync-env.test.ts
(clean, no errors)

Tests Added Or Updated

• tests/unit/sync-env.test.ts — two assertions inverted. They asserted that syncEnv fills JWT_SECRET and API_KEY_SECRET; they now assert both stay blank, joining STORAGE_ENCRYPTION_KEY, which the same test already asserted blank. The rest of the file is untouched, including the added counts, which do not change: the keys are still written, just empty.

Coverage Notes

The only production file is scripts/dev/sync-env.mjs, and both of its write paths go through the same CRYPTO_SECRETS object — the create path (syncEnv) and the append path (getEnvSyncPlan). The test file above exercises both, on a fresh .env and on an existing one.

Reviewer Notes

• This inverts a deliberate assertion, so it deserves the argument stated plainly: the behaviour it asserted is what breaks the durability the rest of the code is built for. The same test already expected the target shape for STORAGE_ENCRYPTION_KEY.
• MACHINE_ID_SALT stays in the list and is untouched. Its .env.example value is not blank, so replaceBlankSecret never rewrites it in practice.
• persistSecret() writes with INSERT OR IGNORE, so the first value persisted wins for good. An install that has been running with a value from the package .env has nothing in the store yet: at its next start it generates one and freezes it. The rotation therefore happens one last time, then never again. Worth deciding whether that deserves a migration or just a release note.
• This does not help an install whose package .env is already filled — it stops creating the trap, it doesn't empty the ones already set. A separate PR adds a warning for that case.
• Leaving the two blank doesn't replay the fix(docker): empty .env secret placeholders override persisted server.env keys → restart crash loop #6824 crash loop. The Next path treats a blank as absent (instrumentation-node.ts:125 and :138), and fix(bootstrap): filter empty process.env values to prevent Docker env crash loop #6828 already filters blank values out of the bootstrap merge.
• scripts/build/bootstrap-env.mjs generates the same two keys, and is deliberately left alone: it persists to DATA_DIR/server.env, which updates do not touch, and it ships with neither its callers nor itself in the published package.