internal/secretbox decodes the standard-base64 key from
MEALQUEST_SECRET_KEY_FILE, requires exactly 32 bytes, and seals secrets as
nonce ‖ ciphertext with a fresh random 12-byte nonce per call. Errors are
sentinels that never carry plaintext, ciphertext or key material.
The server builds the box before opening the database, so a non-base64 or
wrong-length key stops boot with an error naming the variable.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
