Rotate Kaukus credentials exposed during deployment validation

Production secret values were emitted into a private assistant-session tool log when the existing Kamal secret file passed unquoted JSON containing a 1Password section name with a space to `kamal secrets extract`. Known affected categories visible in the emitted excerpt include PostgreSQL, Redis, Swiftner, Fixie, SendGrid, Elastic, Sentry ingestion DSNs, Rails `SECRET_KEY_BASE`, and Lockbox encryption keys. During the production cutover verification, the current Redis password was also embedded in a container command shown by `docker ps` and emitted to the private assistant-session tool log. Exact values must not be copied into this task or any repository artifact. Immediate containment already completed: - Temporary local stdout/stderr and token files were removed. - `.kamal/secrets.production` must pass Kamal's already shell-escaped fetch payload unquoted to `kamal secrets extract`; quoting it preserves backslashes and breaks JSON parsing. Secret-resolution validation remains output-suppressed. Acceptance criteria: - Inventory every field present in the emitted excerpt without reproducing values. - Rotate ordinary service/database credentials and validate dependent services. - Treat `SECRET_KEY_BASE` and Lockbox keys as migration-sensitive: assess session/encrypted-data impact and use an explicit migration or compensating-control plan rather than blind rotation. - Rotate/revoke applicable Sentry DSNs or ingestion keys. - Verify no temporary files, shell history entries, repository changes, or logs contain copied secret values. - Record completion and any deliberately retained key with rationale and compensating controls.