# No manual secrets required — passwords are generated by random_password resources
# and stored in Terraform state. Runner token is fetched from the Gitea API
# automatically after the first deploy.