store secrets outside of stacks.toml

[rafa-stacks]

generate real secrets at config init (auth token, pg password, bitcoind rpcauth) into a gitignored 0600 file, delivered as compose secrets. Today the bitcoind password is a command arg and the pg password is in environment: both readable via docker inspect