Browser-first encryption
Each selected target receives its own encrypted envelope. The API stores ciphertext only.
`env` mode
For single-line secrets. Target installs to a managed `.env` file under the secrets root.
`file` mode
For multiline keys, certs, JSON blobs, or other exact file payloads.
Managed roots
Local installs land under `~/.config/executive-agents-secrets`. Hetzner installs land under `/opt/executive-agents-secrets`.