refactor: reduce deployment to one compose file

internal/secure/secure_test.go

@@ -41,6 +41,34 @@ func TestCipherRoundTripAndFingerprint(t *testing.T) {
 	}
 }
 
+func TestLoadOrCreateCipherPersistsSecureKey(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), "secrets", "master_key")
+	first, err := LoadOrCreateCipher(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if permissions := info.Mode().Perm(); permissions != 0o600 {
+		t.Fatalf("master key permissions = %o, want 600", permissions)
+	}
+	ciphertext, nonce, err := first.Encrypt("persistent token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := LoadOrCreateCipher(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plaintext, err := second.Decrypt(ciphertext, nonce)
+	if err != nil || plaintext != "persistent token" {
+		t.Fatalf("created key was not reused: plaintext=%q err=%v", plaintext, err)
+	}
+}
+
 func TestPasswordHash(t *testing.T) {
 	t.Parallel()
 	hash, err := HashPassword("a secure password")