bmersereau tries to stop a backend secret from doing two jobs

In Mike's backend, the routine that protects users' stored API keys was quietly willing to fall back on the same secret used to verify login tokens if no dedicated encryption secret was configured. bmersereau argued this broke a basic principle: one secret, one job. The proposed change ripped out that fallback and made the dedicated encryption secret mandatory - if it's missing, the system refuses to start rather than silently reusing the auth secret.

The pull request also brought along a small testing harness (vitest, a popular JavaScript test runner) to lock the new behaviour in, and claimed to close four open issues in the tracker. Build green, tests green - and then, after about two days, it was closed without merging. No reason given in the thread.