chore: wire read-only secrets/ volume for session bundles

Mounts ./secrets to /secrets:ro so LINGMA_SESSION_BUNDLE_FILE can point
at a host-managed file without the bundle ever being baked into the
image or committed to git. secrets/ is git-ignored except for .gitkeep
so the directory exists on fresh clones.

Made-with: Cursor

.gitignore

@@ -5,3 +5,5 @@ bin/
 runtime-bin/
 data/*
 !data/.gitkeep
+secrets/*
+!secrets/.gitkeep

docker-compose.yml

@@ -14,4 +14,6 @@ services:
       - "${PORT:-8317}:${PORT:-8317}"
     volumes:
       - ./data:/app/data
+      # Read-only secrets (session bundles, etc). Created outside git; see README.
+      - ./secrets:/secrets:ro
     restart: unless-stopped