## Changes - `internal/config/config.go` — Env-specific loading (dev/staging/prod), validation, in-cluster detection - `internal/config/config_test.go` — 11 tests covering defaults, env override, TLS, prod gates - `k8s/secrets.enc.yaml` — SOPS-encrypted Secret (anthropic key, memory JWT, temporal postgres pw) ## Validation - 11 config tests pass - Full test suite passes (`go test ./...`) - `go build ./...` clean - SOPS encryption verified (age key)
