fix(security): write generated secrets to a 0600 file instead of stdout

CodeQL flagged py/clear-text-logging-sensitive-data on generate-secrets.py:
_print_secret printed each freshly-generated secret value straight to
stdout, which can land in terminal scrollback, screen-recording tools, or
shared sessions.

Values now go to .generated.secrets.env (mode 0600, truncated at the start
of each run so stale secrets from a prior invocation never linger),
gitignored so it can never be committed. Only the env var name and a
"wrote to <path>" confirmation print to stdout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: ivanprytula

.gitignore

@@ -135,6 +135,9 @@ celerybeat.pid
 # For per-environment overrides (e.g. .env.development.local, .env.production.local, etc.) that should not be shared
 .env.*.local
 
+# Output of scripts/tools/generate-secrets.py — NEVER commit this
+.generated.secrets.env
+
 .venv
 env/
 venv/

scripts/tools/generate-secrets.py

@@ -16,6 +16,7 @@
 import argparse
 import secrets
 import string
+from pathlib import Path
 
 
 # ── alphabet definitions ──────────────────────────────────────────────────────
@@ -78,6 +79,23 @@ def _bits_for(length: int) -> int:
     return length * 6  # rough: ~6 bits/char for mixed alpha
 
 
+# ── output file ──────────────────────────────────────────────────────────────
+
+# Overwritten (not appended) on every run so it never accumulates secrets from
+# prior invocations. Must stay out of version control — see .gitignore.
+_OUTPUT_ENV_PATH = Path(".generated.secrets.env")
+_output_file_started = False
+
+
+def _write_secret_line(env_var: str, value: str) -> None:
+    global _output_file_started
+    mode = "w" if not _output_file_started else "a"
+    with _OUTPUT_ENV_PATH.open(mode, encoding="utf-8") as f:
+        f.write(f"{env_var}={value}\n")
+    _output_file_started = True
+    _OUTPUT_ENV_PATH.chmod(0o600)
+
+
 # ── display ───────────────────────────────────────────────────────────────────
 
 
@@ -142,15 +160,17 @@ def _bits_for(length: int) -> int:
 def _print_secret(env_var: str, value: str, label: str, desc: str) -> None:
     print(f"# ── {label} ──")
     print(f"# {desc}")
-    print(f"{env_var}={value}")
+    _write_secret_line(env_var, value)
+    print(f"# Wrote {env_var} to {_OUTPUT_ENV_PATH}")
     print()
 
 
 def _print_all() -> None:
     for env_var, value, label, desc in _SECRET_SPECS:
         _print_secret(env_var, value, label, desc)
 
-    print("# Copy the lines above into your .env and .env.example")
+    print(f"# Secrets were written to {_OUTPUT_ENV_PATH}")
+    print("# Copy values from that file into your .env and .env.example")
     print("# Regenerate any time before deploying to a new environment.")
     print("# Store a backup in your password manager / vault.")