backup: seal the Proton session under a key kept off the volume

WORKSPACE_SESSION_KEY_FILE names a file holding a 32-byte key, meant to
be a Docker secret. When it is set, proton-session.json is written as
AES-256-GCM ciphertext, so a copy of the data volume alone no longer
carries a usable session. That is what the OS keyring gives a native
host, for a container that has no Secret Service.

A plain session found while a key is set is sealed the first time it is
read. A sealed file without its key, or a malformed key file, is an
error at startup rather than a quiet fall back to plain JSON.

.env.example

@@ -59,6 +59,12 @@ WORKSPACE_BACKUP_DEBOUNCE_SEC=300
 # default: a backup that forgets on command is one accident from being none.
 WORKSPACE_BACKUP_PRUNE=0
 
+# Seal the stored Proton session under a key kept off the data volume, so a
+# copy of the volume alone carries no usable session. Point it at a Docker
+# secret (see compose.override.yml.example); `openssl rand -base64 32` makes
+# the key. Losing the key costs a new `proton-login`, nothing more.
+# WORKSPACE_SESSION_KEY_FILE=/run/secrets/session_key
+
 # --- Notification mail -------------------------------------------------------
 # Off until WORKSPACE_SMTP_URL is set. Nothing is even queued while it is unset.