backup: seal the Proton session under a key kept off the volume

WORKSPACE_SESSION_KEY_FILE names a file holding a 32-byte key, meant to
be a Docker secret. When it is set, proton-session.json is written as
AES-256-GCM ciphertext, so a copy of the data volume alone no longer
carries a usable session. That is what the OS keyring gives a native
host, for a container that has no Secret Service.

A plain session found while a key is set is sealed the first time it is
read. A sealed file without its key, or a malformed key file, is an
error at startup rather than a quiet fall back to plain JSON.

compose.override.yml.example

@@ -17,6 +17,10 @@ services:
       - "traefik.http.routers.workspace.entrypoints=websecure"
       - "traefik.http.routers.workspace.tls.certresolver=https_resolver"
       - "traefik.http.services.workspace.loadbalancer.server.port=4242"
+    # The key the Proton session is sealed under, mounted from the host at
+    # /run/secrets/session_key. Needs WORKSPACE_SESSION_KEY_FILE in .env.
+    secrets:
+      - session_key
 
   # Mail, locally. Mailpit accepts everything on 1025 and shows it on 8025, so
   # the reminders can be read before a real relay is ever involved:
@@ -33,6 +37,12 @@ services:
     ports:
       - "127.0.0.1:8025:8025"
 
+secrets:
+  # Outside compose is a plain bind mount, so the file must be readable by
+  # the container's user: `chown 10001 secrets/session.key`.
+  session_key:
+    file: ./secrets/session.key
+
 networks:
   narl:
     external: true