Move Forgejo NSC runtime into agenix

secrets/README.md

@@ -0,0 +1,17 @@
+# Secrets
+
+Burrow secrets live in `secrets/<name>.age` and are managed with `agenix`.
+
+For the Forgejo Namespace Cloud runtime:
+
+- `secrets/forgejo/nsc-token.age`
+- `secrets/forgejo/nsc-dispatcher-config.age`
+- `secrets/forgejo/nsc-autoscaler-config.age`
+
+Use:
+
+- `make secret name=forgejo/nsc-token`
+- `make secret-file name=forgejo/nsc-token file=/path/to/source`
+
+The forge host decrypts these files at activation time and feeds the resulting
+paths into `services.burrow.forgejoNsc`.