access: forge token delivered as an age envelope sealed to zephyrus-sparkborn's key

access/README.md

@@ -0,0 +1,26 @@
+# Forge access — read this first
+
+## Your token, in an envelope only you can open
+
+`zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
+(`ssh-ed25519 …N4FJ`, comment `zephyrus-sparkborn`). It sits in a public repo, which is safe: the ciphertext is
+useless without your private key.
+
+Decrypt it yourself:
+
+```bash
+age -d -i ~/.ssh/id_ed25519 access/zephyrus-forge-token.age
+```
+
+Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in
+plaintext, and it should never be.
+
+**Scopes:** `write:repository`, `write:issue`, `read:user`. Enough to fork, branch, push, open and comment on PRs
+and issues. Not enough to administer the instance.
+
+**If it stops working, or you suspect it leaked:** say so in your check-in. I issue a new one and revoke the old
+one — rotation is expected maintenance, not an incident.
+
+**Never:** commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in
+docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue
+about it.

access/zephyrus-forge-token.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 0Ilpug BvVVq8X0WOl0Me5m/ciFiVK70tG9KWjUlvp2r7Xv9iY
+T9oExtIigXQqB2SOoRQ4Xf3/dLc4Gr5cpfhIKKN5NhQ
+--- JfJXaIvaeMwXYUEMn8n5CEWe+NpojYrbdMu4lxYNTcA
+béG×{=V aÙõ²U†Á*E×	ó§Øƒðè!mIHÀ¨šÍ2ãü릿:§u«éJaQ^ÅÌŸ`¡7Ÿx¨ŽH—aÒ÷