Harden demo secrets: rotate credentials and ship secure demo env template

[johnstel]

Problem statement

Active credentials in .env (Entra client secret, GitHub token, session secret) are a critical demo blocker. Current setup needs immediate rotation and a safe handoff pattern for demo/customer environments.

Priority

P0 — critical security blocker before any customer demo.

Acceptance criteria

• All currently active demo credentials are rotated.
• .env handling is verified safe (.gitignore + no tracked secrets).
• A checked-in .env.demo (or .env.template) is added with placeholder values only.
• Runbook documents secure secret provisioning/rotation flow for demo operators.

Checklist

• Rotate Entra secret.
• Rotate GitHub token/PAT.
• Rotate session secret.
• Verify no secrets in git history for current branch changes.
• Add secure demo config template and docs.

[github-actions]

📋 Assigned to Zoe (Security & Governance)

Issue: #3 — Harden demo secrets: rotate credentials and ship secure demo env template

Zoe will pick this up in the next Copilot session.

For Copilot coding agent: If enabled, this issue will be worked automatically.
Otherwise, start a Copilot session and say:
Zoe, work on issue #3

[johnstel]

@copilot please start on this issue and open a draft PR when ready.