Document and wrap coulomb-social-env secret script

Point operators at railiance-apps create-coulomb-social-env-secret.sh
via scripts/create-env-secret.sh for production Secret assembly.

docs/deploy.md

@@ -8,13 +8,26 @@ railiance01 (same lane as `vergabe-teilnahme`).
 
 ## Runtime secrets (names only)
 
-| Secret | Consumer |
-|--------|----------|
-| `SECRET_KEY` | Django |
-| `DATABASE_URL` | Django |
-| `OIDC_CLIENT_SECRET` | identity app |
-| future DB password | OpenBao dynamic/KV |
+K8s Secret `coulomb-social-env` in namespace `coulomb-social` (chart `envFrom`):
 
+| Key | Source |
+|-----|--------|
+| `SECRET_KEY` | generated by env-secret script |
+| `DATABASE_URL` | cnpg app role secret (URL-encoded password) |
+| `USER_ENGINE_PROXY_SECRET` | `user-engine/user-engine-runtime` |
+
+```bash
+# from railiance-apps:
+make coulomb-social-env-secret-dry-run
+make coulomb-social-env-secret
+
+# from this repo:
+./scripts/create-env-secret.sh --dry-run
+./scripts/create-env-secret.sh
+```
+
+Script: `railiance-apps/tools/create-coulomb-social-env-secret.sh`  
+OIDC is a **public** client — no client secret.
 ## Health
 
 - `GET /healthz` → `{"status":"ok"}`