Read credentials from files, not only the environment

Found by packaging the service for Railiance (rapp-canned-prompts). Every other
rapp in the fleet mounts its database credential as a file; this service could
only read CANNED_PROMPTS_DATABASE_URL from the environment, which would have
put a database password into kubectl describe, into crash dumps, and in reach
of anything able to read /proc.

Adds CANNED_PROMPTS_DATABASE_URL_FILE and CANNED_PROMPTS_PUBLISH_TOKEN_FILE. A
mounted secret stays a file. When both forms are set the file wins, because a
rotated secret must take effect rather than be shadowed by a stale env var, and
an unreadable secret file fails loudly rather than falling back to a value that
may be older.

Service tests 33 -> 36.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

service/tests/test_health.py

@@ -100,3 +100,26 @@ def test_settings_have_no_database_fallback() -> None:
     """Falling back to a local database when misconfigured hides the mistake."""
     assert Settings().database_url == ""
     assert Settings().configured is False
+
+
+def test_database_url_may_come_from_a_file(tmp_path: Path) -> None:
+    """A mounted secret should stay a file, not become an env var."""
+    secret = tmp_path / "url"
+    secret.write_text("sqlite:///from-file.db\n", encoding="utf-8")
+    settings = Settings(database_url_file=str(secret))
+    assert settings.configured is True
+    assert settings.resolved_database_url == "sqlite:///from-file.db"
+
+
+def test_file_wins_over_env_when_both_are_set(tmp_path: Path) -> None:
+    """A rotated secret must take effect, not be shadowed by a stale env var."""
+    secret = tmp_path / "url"
+    secret.write_text("sqlite:///from-file.db", encoding="utf-8")
+    settings = Settings(database_url="sqlite:///from-env.db", database_url_file=str(secret))
+    assert settings.resolved_database_url == "sqlite:///from-file.db"
+
+
+def test_unreadable_secret_file_fails_loudly(tmp_path: Path) -> None:
+    settings = Settings(database_url_file=str(tmp_path / "missing"))
+    with pytest.raises(RuntimeError, match="cannot read secret file"):
+        _ = settings.resolved_database_url