Take the master key from KEEPORG_MASTER_KEY_FILE

Why: the usual way to hand a secret to a container is to mount it as a file
and name the path in the environment. Compose, swarm and Kubernetes all do
it that way, and it keeps the key out of the process environment and off any
disk the container can write.

What: the master key is now looked for in KEEPORG_MASTER_KEY, then
KEEPORG_MASTER_KEY_FILE, then the configured master_key_file. A secret file
may hold base64, with or without padding or a trailing newline, or exactly
32 raw bytes, because secret stores produce both.

Only the configured path is ever created, which is what keeps a plain
package install working with no setup. The two environment variables name a
key something else owns, so a missing one is reported and vault creation
refused. Minting a replacement there would be worse than failing: it opens
none of the existing vaults, and the mistake would otherwise surface one
failed merge at a time.

The compose example now provisions the key as a real secret rather than an
environment variable, and the Dockerfile and README show the same. Neither
names a version any more, so they stop drifting as the server is bumped.

Proved: unit tests for every source and precedence, all four accepted
encodings, and that a missing secret writes nothing anywhere. In real
containers: a podman secret carrying base64 survives a stop and start with
"1 vault keys available for merging" and merges a stale push afterwards; a
secret holding 32 raw bytes creates a vault; and a secret that failed to
mount is named in the startup log, with vault creation answering with the
three places a key may come from.

Dockerfile

@@ -7,8 +7,8 @@
 # to an OIDC provider, and nothing else. There is no shell in it: the binary
 # probes its own health.
 #
-#   podman build --format docker -t keeporgd:0.3.0 --build-arg VERSION=0.3.0 .
-#   docker build -t keeporgd:0.3.0 --build-arg VERSION=0.3.0 .
+#   podman build --format docker -t keeporgd:<version> --build-arg VERSION=<version> .
+#   docker build -t keeporgd:<version> --build-arg VERSION=<version> .
 #
 # podman needs --format docker, because the OCI image format has no
 # HEALTHCHECK field and drops it silently.
@@ -55,14 +55,21 @@ COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certifica
 # KEEPORG_MASTER_KEY, the master key that unwraps the vault keys. They are
 # separate on purpose: whoever holds both can read every merge vault.
 #
-# Give the master key somewhere durable, one of these two ways:
+# Give the master key somewhere durable, one of these three ways:
 #
-#   -e KEEPORG_MASTER_KEY="$(head -c 32 /dev/urandom | base64)"   (preferred)
+#   --secret keeporg_master_key -e KEEPORG_MASTER_KEY_FILE=/run/secrets/keeporg_master_key
+#   -e KEEPORG_MASTER_KEY="$(head -c 32 /dev/urandom | base64)"
 #   -v keeporg-config:/etc/keeporg
 #
-# With neither, the server mints a key into the container's own layer on
-# first start and loses it on the next `run`. It says so loudly at startup,
-# and merging is all that stops working: clients still open their vaults.
+# The first is preferred: the key is never in the process environment and
+# never on a disk this container can write. The file may hold base64 or 32
+# raw bytes. Neither environment variable is ever created by the server, so
+# a secret that failed to mount is reported instead of being replaced.
+#
+# With none of the three, the server mints a key into the container's own
+# layer on first start and loses it on the next `run`. It says so loudly at
+# startup, and merging is all that stops working: clients still open their
+# vaults.
 COPY --from=build --chown=65532:65532 /out/var/lib/keeporg /var/lib/keeporg
 COPY --from=build --chown=65532:65532 /out/etc/keeporg /etc/keeporg
 VOLUME ["/var/lib/keeporg", "/etc/keeporg"]