Secrets (gitignored)

Put the Firebase service account JSON here as:

secrets/firebase-service-account.json

Never commit this file. Docker Compose mounts ./secrets read-only into core-backend as /secrets (FCM_SERVICE_ACCOUNT_FILE).