AES-256-GCM encrypted secret manager. Replace .env files and hardcoded credentials with a secure, local vault backed by macOS Keychain.