Zero-trust encrypted secret sync for .env files. PBKDF2 key derivation, AES-256-GCM, Cloudflare R2 storage, fully open source.