Перенесены секреты из .env в SM

ops-monitoring/diagnose-han-chat.sh

@@ -2,13 +2,23 @@
 # diagnose-han-chat.sh — запускать из /opt/han-chat/backend
 set -euo pipefail
 cd /opt/han-chat/backend
+CONFIG_FILE="${CONFIG_FILE:-.env}"
+SECRETS_LAUNCHER="${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}"
+if [[ "${HAN_SECRETS_ACTIVE:-0}" != 1 ]]; then
+  [[ -x "$SECRETS_LAUNCHER" ]] || {
+    echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
+    exit 66
+  }
+  exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
+fi
+compose() { docker compose --env-file "$CONFIG_FILE" "$@"; }
 
 echo "=== 1. Статус сервисов ==="
-docker compose --env-file .env ps api-backend keycloak redis message-safety
+compose ps api-backend keycloak redis message-safety
 
 echo
 echo "=== 2. Healthcheck api-backend (что именно падает) ==="
-docker compose --env-file .env exec -T api-backend \
+compose exec -T api-backend \
   python -c "
 import json, urllib.request
 try:
@@ -22,13 +32,13 @@ except urllib.error.HTTPError as e:
 
 echo
 echo "=== 3. Keycloak health (management port 9000) ==="
-docker compose --env-file .env exec -T keycloak bash -c \
+compose exec -T keycloak bash -c \
   "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /auth/health/ready HTTP/1.0\r\n\r\n' >&3 && cat <&3" \
   2>/dev/null | head -20 || echo "Keycloak health FAILED"
 
 echo
 echo "=== 4. api-backend -> Keycloak (JWKS) ==="
-docker compose --env-file .env exec -T api-backend \
+compose exec -T api-backend \
   python -c "
 import os, urllib.request, json
 base = os.environ.get('KEYCLOAK_INTERNAL_URL','http://keycloak:8080/auth').rstrip('/')