Rotate secrets

Rotate these in the host (Render dashboard or .env locally), then restart the web service:

1. TOOL_SHARED_SECRET — header x-tool-secret on /api/tools/*. Also update every ElevenLabs server tool.
2. ADMIN_ROUTE_PREFIX — URL path and header x-admin-prefix. Must match what /api/bootstrap returns to the SPA. If VITE_ADMIN_ROUTE_PREFIX is set at build time, rebuild the SPA or rely on bootstrap (runtime wins after load).
3. ELEVENLABS_WEBHOOK_SECRET — HMAC on POST /api/webhooks/elevenlabs. Update the webhook in the ElevenLabs dashboard.
4. ELEVENLABS_API_KEY / ANTHROPIC_API_KEY — provider keys.
5. DATABASE_URL — Neon. Treat as a secret.

Do not commit rotated values. .env is gitignored.