docs: describe TreatVault service bootstrap

README.md

@@ -25,6 +25,7 @@ The current schema defines one `pawsql` block with a listener, an optional TLS `
 
 - `upstream <host:port>` for an external PostgreSQL server.
 - `postgres { ... }` for a managed PostgreSQL container. Its `image`, `volume`, and `password_secret` directives are required. `password_secret` is a short lowercase reference resolved to the Docker secret `barkstack_<reference>`. `idle_timeout` and `traffic_idle_timeout` accept Go duration strings.
+- `treatvault { ... }` (optional, top-level) configures TreatVault: `file` is the path to the age-encrypted secret source of truth, and `identity_secret` is a short reference for the Docker secret holding the age identity (`barkstack_<reference>`).
 
 ```text
 pawsql {
@@ -48,11 +49,7 @@ pawsql {
 }
 ```
 
-Create the referenced secret before deploying PawSQL:
-
-```sh
-docker secret create barkstack_application_postgres_password /secure/path/application-postgres-password
-```
+With TreatVault configured, create the referenced password through the TreatVault page in the Barkstack Console. `barkstack init` creates the identity Docker secret when absent; the TreatVault service initializes the encrypted file and creates the Docker secret on sync.
 
 ## Watch validated changes