Read credentials from files, not only the environment

Found by packaging the service for Railiance (rapp-canned-prompts). Every other
rapp in the fleet mounts its database credential as a file; this service could
only read CANNED_PROMPTS_DATABASE_URL from the environment, which would have
put a database password into kubectl describe, into crash dumps, and in reach
of anything able to read /proc.

Adds CANNED_PROMPTS_DATABASE_URL_FILE and CANNED_PROMPTS_PUBLISH_TOKEN_FILE. A
mounted secret stays a file. When both forms are set the file wins, because a
rotated secret must take effect rather than be shadowed by a stale env var, and
an unreadable secret file fails loudly rather than falling back to a value that
may be older.

Service tests 33 -> 36.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

service/src/canned_prompts_service/settings.py

@@ -8,13 +8,20 @@ that refuses to start.
 
 from __future__ import annotations
 
+from pathlib import Path
+
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(env_prefix="CANNED_PROMPTS_", extra="ignore")
 
+    # Two ways in, and the file is the one to use in a cluster: an env var
+    # holding a password is visible in `kubectl describe`, in crash dumps, and
+    # to anything that can read /proc. The file form lets a mounted secret stay
+    # a file.
     database_url: str = ""
+    database_url_file: str = ""
     tenant: str = "default"
     service_name: str = "canned-prompts"
 
@@ -24,9 +31,32 @@ class Settings(BaseSettings):
     publish_token: str = ""
     publisher_name: str = "operator"
 
+    publish_token_file: str = ""
+
+    def _read_secret(self, path: str) -> str:
+        try:
+            return Path(path).read_text(encoding="utf-8").strip()
+        except OSError as exc:
+            raise RuntimeError(f"cannot read secret file {path}: {exc}") from exc
+
+    @property
+    def resolved_database_url(self) -> str:
+        """The file wins when both are set: a mounted secret is the stronger
+        statement of intent, and silently preferring the env var would make a
+        rotated credential look like it had not taken effect."""
+        if self.database_url_file:
+            return self._read_secret(self.database_url_file)
+        return self.database_url
+
+    @property
+    def resolved_publish_token(self) -> str:
+        if self.publish_token_file:
+            return self._read_secret(self.publish_token_file)
+        return self.publish_token
+
     @property
     def configured(self) -> bool:
-        return bool(self.database_url)
+        return bool(self.database_url or self.database_url_file)
 
 
 def get_settings() -> Settings: