Reads JWT_SECRET_KEY and KEBOOLA_STORAGE_TOKEN from Secret Manager, combines with non-secret config, writes .env with chmod 600. Run as part of VM startup or manually for rotation.
