feat: add sessionSecretFile and oauthClientSecretFile for JSON config

lib/auth/session-secret.ts

@@ -23,7 +23,12 @@ export function getSessionSecret(): string {
   if (fromFile) return fromFile;
 
   const fromAdmin = configManager.get<string>('sessionSecret', '');
-  return fromAdmin || '';
+  if (fromAdmin) return fromAdmin;
+
+  const fromAdminFile = readFileEnv(
+    configManager.get<string>('sessionSecretFile', ''),
+  );
+  return fromAdminFile || "";
 }
 
 export function hasSessionSecret(): boolean {

lib/oauth/token-exchange.ts

@@ -19,6 +19,12 @@ export function getDiscoveryValidator(): EndpointValidator | undefined {
 function getGlobalClientSecret(): string {
   const adminSecret = configManager.get<string>('oauthClientSecret', '');
   if (adminSecret) return adminSecret;
+
+  const adminFileSecret = readFileEnv(
+    configManager.get<string>('oauthClientSecretFile', ''),
+  );
+  if (adminFileSecret) return adminFileSecret;
+
   return process.env.OAUTH_CLIENT_SECRET || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE) || '';
 }