Secrets live in orbit_settings so a .env rewrite cannot wipe SendGrid or the Grok key used for Estimate hours.