build(intake): give the containers an INTAKE_ACTION_SECRET (#224)

A gap in the plan rather than in the code: nothing wired the secret into either stack, so the feature would have shipped with its signed links permanently disabled and nothing saying why. Both compose files now interpolate it, with `:-` so an unset variable stays empty rather than failing the deploy.

QA takes QA_INTAKE_ACTION_SECRET, its own value rather than production's, for the same reason as every other QA_ prefixed credential — and more sharply here, because a link signed with it acts on a draft without a login.

Rotating the secret revokes every outstanding link, which is the intended answer to one leaking.

The cutover doc counted fourteen interpolated names and now counts fifteen. That document says it is checked against the file rather than from memory, so it was: fifteen in the compose file, the same fifteen listed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.qa.yml

@@ -54,6 +54,10 @@
 #                     credential here that spends money per call, and it is
 #                     reachable by anyone holding an upload link. Leave it unset
 #                     and submissions still arrive, undrafted.
+#   QA_INTAKE_ACTION_SECRET — optional. Signs the regenerate and discard links
+#                     in the notification email (#224). Absent, the email still
+#                     sends and simply carries no shortcuts. Its own value, not
+#                     production's: a link signed with it acts without a login.
 
 services:
   redefined-designs-qa:
@@ -144,6 +148,14 @@ services:
       # consignment to an expired key would be far worse than an item arriving
       # without its description written.
       - ANTHROPIC_API_KEY=${QA_ANTHROPIC_API_KEY}
+
+      # Signs the regenerate and discard links in the intake notification email
+      # (#224). Optional: absent, the notification still sends and simply links
+      # to the review queue without shortcuts. Anyone holding a link can act on
+      # it without signing in, so this must not be shared with production —
+      # rotating it revokes every outstanding link, which is the intended way to
+      # deal with a leak.
+      - INTAKE_ACTION_SECRET=${QA_INTAKE_ACTION_SECRET:-}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.