SECURE SETUP
Connect CARL
Secrets are written only to CARL’s private local configuration file. They are never displayed again, returned by the server, or committed to GitHub.
CARL accepts setup only from this Mac while bound to 127.0.0.1. The private
.env file is ignored by Git and saved with owner-only permissions.