feat!: replace password environment with Docker secret references

schema.go

@@ -26,13 +26,15 @@ type DatabaseConfig struct {
 	Postgres *PostgresConfig
 }
 
-// PostgresConfig declares a PawSQL-managed PostgreSQL container. IdleTimeout
-// starts after the last proxied client session closes. TrafficIdleTimeout
-// applies to open sessions with no proxied bytes. Zero disables either timeout.
+// PostgresConfig declares a PawSQL-managed PostgreSQL container. PasswordSecret
+// is a short Barkfile reference resolved to a Docker secret named
+// barkstack_<reference>. IdleTimeout starts after the last proxied client
+// session closes. TrafficIdleTimeout applies to open sessions with no proxied
+// bytes. Zero disables either timeout.
 type PostgresConfig struct {
 	Image              string
 	Volume             string
-	PasswordEnv        string
+	PasswordSecret     string
 	IdleTimeout        time.Duration
 	TrafficIdleTimeout time.Duration
 }