A command-line tool for the server that walks every .env file — the
migrated secret folders as well as the old config files inside the
projects. It can list, read and set entries, and re-issue them with
roll while keeping the shape of the old value: hex stays hex, base64
stays base64, UUID stays UUID.
Database passwords and public keys are skipped unless they are named
explicitly. Every run backs up the previous values, validates the
configuration and restores the old state if a service does not come back.
The values themselves are generated on the host and only printed by
show — freshly issued keys never show up in a chat or an AI
conversation. 89 automated tests cover the tool.