Secrets & key management: get signing keys off plaintext-on-disk before mainnet

[VAIBHAVJINDAL3012]

Summary

Get secrets and signing keys off plaintext-on-disk before mainnet.

Why

Today: DEX tokens (SOLVER_ROUTER_TOKENS) + admin token live in systemd env drop-ins, and the solver/mirror signing keystores sit in plaintext on the box disk. On mainnet that's money-loss risk, not just hygiene.

Scope

• Tokens + config secrets → a managed store (AWS Secrets Manager / SSM Parameter Store); rotate without hand-editing the box.
• Account signing keys → KMS/HSM, or at minimum encrypted-at-rest with tight IAM and no shell-history exposure.
• Ties into the pentest findings.

Acceptance criteria

• No plaintext secrets/keys on disk or in shell history.
• Keys/tokens loaded from a managed store at runtime.
• Documented rotation procedure.