Перенесены секреты из .env в SM

codebase/backend/deployment/scripts/rollback.sh

@@ -1,21 +1,34 @@
 #!/bin/sh
 set -eu
 cd "$(dirname "$0")/../.."
+CONFIG_FILE=${CONFIG_FILE:-.env}
+SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
 
-previous_env=${1:-}
-if [ -z "$previous_env" ] || [ ! -r "$previous_env" ]; then
-  echo "Usage: $0 /secure/path/previous-release.env" >&2
+previous_release=${1:-}
+if [ -z "$previous_release" ]; then
+  echo "Usage: $0 <previous-immutable-release>" >&2
   exit 64
 fi
+if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
+  [ -x "$SECRETS_LAUNCHER" ] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
 if [ "${SCHEMA_BACKWARD_COMPATIBLE_CONFIRMED:-false}" != "true" ]; then
   echo "Refusing rollback: set SCHEMA_BACKWARD_COMPATIBLE_CONFIRMED=true after migration review." >&2
   exit 64
 fi
 
-./scripts/validate-env "$previous_env"
-docker compose --env-file "$previous_env" config --quiet
-docker compose --env-file "$previous_env" up -d --remove-orphans
-docker compose --env-file "$previous_env" ps
+if [ -n "${HAN_RUNTIME_SECRET_MANIFEST:-}" ]; then
+  ./scripts/validate-env "$CONFIG_FILE" --runtime-manifest "$HAN_RUNTIME_SECRET_MANIFEST"
+else
+  ./scripts/validate-env "$CONFIG_FILE" --runtime-env
+fi
+RELEASE_VERSION="$previous_release" docker compose --env-file "$CONFIG_FILE" config --quiet
+RELEASE_VERSION="$previous_release" docker compose --env-file "$CONFIG_FILE" up -d --remove-orphans
+docker compose --env-file "$CONFIG_FILE" ps
 
 echo "Application images rolled back without Alembic downgrade."
-echo "Run deployment/scripts/smoke.sh with ENV_FILE=$previous_env and verify outbox/inbox idempotency."
+echo "Run deployment/scripts/smoke.sh and verify outbox/inbox idempotency."