fix: split ambiguous AUTH_SECRET and remove dead Matrix routes

RESUME_AUTH_SECRET and FAMAPP_AUTH_SECRET now replace the bare AUTH_SECRET (previously defined 3x in .env, last-wins). Each is pinned to the value its container is already running, so re-applying recreated nothing. This fixes resume's app reading \\\, which was undefined and resolved to an empty string -- the next container recreate would have wiped all resume sessions. Caddyfile: removed matrix.ginnoir.com and the ginnoir.com apex .well-known/matrix block (no Synapse backend on :8008). Applied to valhalla: dc config resolves with no warnings, Caddy reloaded, dc up -d left every service up-to-date.

.env

@@ -38,9 +38,10 @@ POSTGRES_PASSWORD=postgres
 MINIO_ROOT_USER=minioadmin
 MINIO_ROOT_PASSWORD=minioadmin
 CHROME_TOKEN=chrome_token
-# IMPORTANT: Replace this before exposing resume.ginnoir.com publicly.
-# Generate with: openssl rand -hex 64
-AUTH_SECRET=CHANGE_ME_USE_openssl_rand_hex_64
+# Auth/JWT signing secret for Reactive Resume — the `app` service reads
+# ${RESUME_AUTH_SECRET}. Pinned to the value the running container already uses,
+# so recreating it does not invalidate sessions. Rotate with: openssl rand -hex 64
+RESUME_AUTH_SECRET=1b7e96f61f080d04d4bf673d9ea1d9349eb7693cddee5772b6c3f153c88032db5b97efd8570087bc6f340d2cd874aabc1e5c681bc22889921240d6a23738bc7f
 
 # =============================================================
 # FRESHRSS
@@ -49,8 +50,6 @@ FRESHRSS_API_PASSWORD=d0fet0th3x
 FRESHRSS_PASSWORD=d0fet0th3x
 FRESHRSS_EMAIL=3nigma.matt@gmail.com
 
-AUTH_SECRET=b4c032c8475cdd21e9138f2178c862f79cb6302ebf90e561cdea4cd6efcfe61e4ee03f5a4b3405c3c99239b734c8f387c6c3547d6c5b8f1c7d7db2b81c01ce0b
-
 # ── famapp ────────────────────────────────────────────────────────────────────
 FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
 FAMAPP_PULL_POLICY=always
@@ -62,7 +61,8 @@ FAMAPP_DB_USER=famapp
 FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
 FAMAPP_DB_NAME=famapp
 
-AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
+# famapp Auth.js session secret (compose maps this to the container's AUTH_SECRET)
+FAMAPP_AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
 
 # Fill in after Authentik bootstrap
 AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/