
Preview, staging and production described in one file that goes through review like any other change.

Everything the dashboard does is available from the command line and the API — no second-class paths.

Encrypted at rest, scoped per environment, injected at runtime, never printed in logs.