Mirror was stale (missing ~28 services incl. LubeLogger). Sync live->mirror and
redact every inline widget secret (19: plex/overseerr/tautulli/arr/sab keys +
proxmox/pbs/beszel/crowdsec passwords) to {{HOMEPAGE_VAR_*}} refs. Values now
live only in observability/.env (root:600, not a git repo), injected via env_file.
Verified: 21 referenced vars == 21 defined in container env (no referenced-but-
undefined); homepage healthy, widgets authenticate. Full-file + diff scan: clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tommy
b22697b2b9