fix(6244): the instance keeps its own SECRET_KEY in /data, and docker-compose.yml is the compose users deploy from

With no SECRET_KEY set, Grimoire fell back to a fixed placeholder. The
quickstart compose substituted change-me-in-production, so the README's
own update step (pull, up -d) recreated the container on that placeholder,
and every credential sealed under the key the user started with stopped
opening.

- config: with neither SECRET_KEY nor SECRET_KEY_FILE, the first start
  writes a random key to DATA_DIR/secret_key (mode 0600, published with a
  hard link so concurrent starts agree), and later starts read it back.
  An explicit key wins and leaves the file alone. A missing
  SECRET_KEY_FILE or an empty key file stops the start instead of
  switching keys. With no data directory (a run outside the container)
  the process gets a temporary key and says so.
- app: warns on a public placeholder key, on a temporary key, and when
  /data is not a mounted volume.
- Dockerfile creates /data.
- docker-compose.yml is now the deploy compose (published image, both
  volumes, nothing to set). The build-from-source compose is
  docker-compose.dev.yml, and docker-compose.quickstart.yml is gone. The
  Swarm stack file gains the /data volume and keeps its explicit key,
  because a Swarm can move the app away from a node-local volume.
- README: a Deploy section with the compose inline, SECRET_KEY optional,
  "keep both volumes", and updates that keep the key. A test holds the
  README's copy equal to the file.
- Installs that ran on the change-me-in-production placeholder get a key
  of their own on the new compose; Settings then asks once for saved
  forge tokens and the backup secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/grimoire/app.py

@@ -1,11 +1,12 @@
 import logging
+import os
 import time
 import traceback as tb_module
 from pathlib import Path
 
 from quart import Quart, g, jsonify, make_response, request, send_from_directory
 
-from grimoire.config import Config
+from grimoire.config import PLACEHOLDER_SECRET_KEYS, SECRET_KEY_FILENAME, Config
 from grimoire.routes.admin import admin_bp
 from grimoire.routes.api import api
 from grimoire.routes.auth import auth_bp
@@ -62,10 +63,23 @@ def create_app() -> Quart:
     app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
     app.config["SESSION_COOKIE_SECURE"] = Config.SECURE_COOKIES
 
-    if Config.SECRET_KEY == "dev-secret-change-me":
+    if Config.SECRET_KEY in PLACEHOLDER_SECRET_KEYS:
         logger.warning(
-            "SECRET_KEY is set to the default value — session cookies are insecure. "
-            "Set SECRET_KEY or SECRET_KEY_FILE for production use."
+            "SECRET_KEY is set to a public placeholder, so session cookies are insecure. "
+            "Remove it to let the instance keep its own key in %s, or set a real one.",
+            Config.DATA_DIR,
+        )
+    if Config.SECRET_KEY_SOURCE == "ephemeral":
+        logger.warning(
+            "No SECRET_KEY is set and %s does not exist, so this process is using a "
+            "temporary key. Sessions and saved credentials will not survive a restart.",
+            Config.DATA_DIR,
+        )
+    elif Config.SECRET_KEY_SOURCE == "data" and not os.path.ismount(Config.DATA_DIR):
+        logger.warning(
+            "%s is not a mounted volume. The instance's key (%s) and the model cache "
+            "are lost when the container is recreated; mount a volume there.",
+            Config.DATA_DIR, SECRET_KEY_FILENAME,
         )
 
     if not Config.TRUST_PROXY_HEADERS: