[Feature]: MCPPROXY_API_KEY_FILE (and ${file:} for api_key) for container and systemd secrets #1706

Problem / motivation

Spec 111 (FR-030) plans ${file:/absolute/path} references so that upstream server secrets can come from a file (Docker/Compose secrets, Kubernetes secrets, systemd LoadCredential=). The code does not have it yet (no ${file: handling in internal/secret, only ${env:} and keyring), and the spec does not cover the proxy's own credential:

• api_key can come from MCPPROXY_API_KEY, but there is no file form. In a container the choices today are an environment variable (visible in docker inspect, /proc/<pid>/environ and crash dumps) or the key saved in mcp_config.json on the data volume.
• Both Docker Compose secrets and Kubernetes mount a secret as a file (/run/secrets/<name>), and the convention used by most official images is a <NAME>_FILE variable that points at it.

I checked MCPPROXY_API_KEY_FILE and ${file:} in the tree and in the open and closed issues and found neither (#58 asked for credentials not to be stored in plaintext in the config, and was closed).

Proposed solution

Add MCPPROXY_API_KEY_FILE: when set, and MCPPROXY_API_KEY is not, read the key from that file (strip one trailing newline, as FR-030 does), never write it back to the config, never log it. Same rule for ${file:} if it is also accepted inside api_key. If MCPPROXY_API_KEY_FILE is the only thing that is wanted, it can ship before FR-030 does.

I can send a PR for this if it fits Spec 111's plan. I did not want to overlap with whoever implements FR-030.

Alternatives considered

• Keep using MCPPROXY_API_KEY and set it from a wrapper entrypoint that reads the file. This needs a shell, which the slim image does not have.
• Let the key be generated and saved to the volume (FR-014). Works for a single operator, but does not fit a secrets manager, rotation, or an agent that needs to be given the key without the config file.

Which edition?

Both (personal and server).

• I searched existing issues and discussions for a similar request (searched api_key file secret, ${file:}, MCPPROXY_API_KEY_FILE; related: Spec 111 FR-014/FR-030, Avoid storing credentials in mcpproxy.json in plaintext #58)