infra(docker-env2)+infra(docker): init:true + secrets posture parity for env2; regen-proto EXIT trap (arch-review 2026-08-19 P8-2 + P8-3 + P8-4)

docker-env2/central-node-a/appsettings.Central.json

@@ -20,20 +20,27 @@
       "MinNrOfMembers": 1
     },
     "Database": {
-      "ConfigurationDb": "Server=scadabridge-mssql,1433;Database=ScadaBridgeConfig2;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true",
-      "MachineDataDb": "Server=scadabridge-mssql,1433;Database=ScadaBridgeMachineData2;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true"
+      "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker-env2/docker-compose.yml (dev-only-insecure, mirroring docker/docker-compose.yml and the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
     },
     "Security": {
       "Ldap": {
-        "Server": "10.100.0.35",
+        "Server": "host.docker.internal",
         "Port": 3893,
+        "FallbackServers": [
+          "host.docker.internal:3894"
+        ],
+        "_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host — mirrors docker/central-node-a/appsettings.Central.json. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds; env2 hit this directly (every login failing) before this fix.",
         "Transport": "None",
         "AllowInsecure": true,
         "SearchBase": "dc=zb,dc=local",
         "ServiceAccountDn": "cn=serviceaccount,dc=zb,dc=local",
-        "ServiceAccountPassword": "serviceaccount123"
+        "_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-env2/docker-compose.yml (dev-only-insecure)."
       },
-      "JwtSigningKey": "scadabridge-env2-dev-jwt-signing-key-must-be-at-least-32-characters-long",
+      "Auth": {
+        "DisableLogin": false,
+        "User": "multi-role"
+      },
+      "_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-env2/docker-compose.yml (dev-only-insecure).",
       "JwtExpiryMinutes": 15,
       "IdleTimeoutMinutes": 30,
       "RequireHttpsCookie": false,