Secret expansion

Don't write secrets such as client_secret, jwt_secret, or postgres_url directly in gateway.yaml. Reference them with one of the forms below, and the gateway resolves the value at boot from an environment variable or a file:

Form	Resolves to	Use for
${VAR}	The environment variable VAR. Boot fails if undefined.	Container environment variables, AWS Secrets Manager via env injection
${file:/path\}	Contents of the file at that absolute path, trimmed. The reference must be the field's entire value: unlike $\{VAR\}, it isn't expanded inside a longer string, so for a database password set store.password rather than embedding it in postgres_url.	Kubernetes Secret volume mounts, Vault Agent, SOPS