BACH Handler: Secrets
---------------------

Secure management of API keys, tokens and access data.

USE
----------

  bach --secrets list                Show all secrets (keys only)
  bach --secrets get <key>           Retrieve the value of a secret
  bach --secrets set <key> <value>   Set/update secret
  bach --secrets delete <key>        Delete secret

OPTIONS
--------

  --category <cat> Category (general, api, telegram, etc.)
  --description <text> Description of the secret

LOCATION
-----------

  ~/.bach/bach_secrets.json (encrypted with Fernet)
  Configured in system_config: secrets_file_path

SECURITY
----------

  - Secrets are encrypted with Fernet (AES-128-CBC).
  - Salt: Fixed 16 bytes (not newline-delimited!)
  - Never commit secrets to Git
  - Secrets file in .gitignore

MODULE
-----

  hub/secrets_handler.py (SecretsHandler)
