Replace fragile .env backup/restore with Vault-based secret injection. Secrets are preloaded via --import hook before NestJS modules evaluate, with a 30s refresh loop and event-driven cache invalidation for services that read secrets at init (JWT, CSRF, WHMCS). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>