runtime: derive secret keys with hkdf

TASKS.md

@@ -2,18 +2,18 @@
 
 ## Current
 
-### `feat/secret-crypto-hkdf`
+### `feat/postgres-pool-config`
 
 Status: in_progress
 
 DoD:
-- master key derivation uses HKDF-SHA256 instead of raw SHA256
-- secret encryption/decryption compatibility is explicit and tested
-- admin-api and runtime continue to handle secret crypto through the shared path
+- PostgreSQL pool settings are explicit instead of implicit sqlx defaults
+- pool sizing and timeouts come from runtime config/env
+- startup validates pool configuration and tests cover parsing/defaults
 
 ## Next
 
-- `feat/postgres-pool-config`
+- `feat/postgres-registry-modularization`
 
 ## Backlog