feat: add secret store foundation

docs/runtime-config.md

@@ -65,13 +65,13 @@ var/crank/
 - `CRANK_MCP_REFRESH_MS`
 - `CRANK_LOG_LEVEL`
 - `CRANK_SECRET_PROVIDER`
+- `CRANK_MASTER_KEY`
 - `CRANK_PUBLIC_BASE_URL`
 - `CRANK_MCP_PUBLIC_URL`
 
 Опционально:
 
 - `CRANK_ADMIN_TOKEN`
-- `CRANK_MASTER_KEY`
 - `CRANK_DEMO_SEED`
 
 Стартовое значение для refresh published tools:
@@ -131,6 +131,10 @@ Demo/deployment:
 - `CRANK_BOOTSTRAP_ADMIN_PASSWORD`
 - `CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME`
 
+Для secret store foundation нужен:
+
+- `CRANK_MASTER_KEY`
+
 Для опционального demo-seed:
 
 - `CRANK_DEMO_SEED=true`