refactor(config): drop the dead secrets.session_key

REVIEW-001 (M0) L1c/L2s: secrets.session_key was validated and generated by
the wizard but never read by any code path — dead config (KISS).

Remove the field, its validation entry and its generation; the example notes
that a placeholder is replaced at startup in setup mode (M1s) as well as by
the wizard's finish.

config.example.yaml

@@ -29,8 +29,10 @@ database:
   path: "./data/myday.db"   # SQLite · WAL · foreign keys ON · one instance only
 
 # ── secrets — generate strong random values; never commit (D-010) ────────────
+# A placeholder is replaced with a strong value: at startup in setup mode
+# (so the wizard's ceremony is never signed with a known key) and again by the
+# wizard's `finish`. A restart adopts what `/setup` persisted.
 secrets:
-  session_key: "CHANGE_ME_32_BYTES_RANDOM"
   cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
   csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
   totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"   # A9 — TOTP secrets are encrypted at rest

internal/core/config/config.go

@@ -89,8 +89,9 @@ type Database struct {
 }
 
 // Secrets holds the symmetric key material (D-010). Never commit real values.
+// The wizard generates a strong value for any field left at a placeholder
+// (R-6); the startup path does the same in setup mode (M1s).
 type Secrets struct {
-	SessionKey        string `yaml:"session_key"`
 	CookieSecret      string `yaml:"cookie_secret"`
 	CSRFKey           string `yaml:"csrf_key"`
 	TOTPEncryptionKey string `yaml:"totp_encryption_key"` // A9
@@ -236,7 +237,6 @@ func (c *Config) Validate() error {
 	}
 
 	for _, s := range []struct{ name, value string }{
-		{"secrets.session_key", c.Secrets.SessionKey},
 		{"secrets.cookie_secret", c.Secrets.CookieSecret},
 		{"secrets.csrf_key", c.Secrets.CSRFKey},
 		{"secrets.totp_encryption_key", c.Secrets.TOTPEncryptionKey},

internal/core/config/config_test.go

@@ -34,7 +34,6 @@ app:
 database:
   path: "./data/myday.db"
 secrets:
-  session_key: "CHANGE_ME_32_BYTES_RANDOM"
   cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
   csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
   totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"
@@ -57,7 +56,6 @@ server:
 database:
   path: "./data/myday.db"
 secrets:
-  session_key: "0123456789abcdef0123456789abcdef"
   cookie_secret: "0123456789abcdef0123456789abcdef"
   csrf_key: "0123456789abcdef0123456789abcdef"
   totp_encryption_key: "0123456789abcdef0123456789abcdef"
@@ -280,7 +278,7 @@ func TestMarshalRoundTrip(t *testing.T) {
 		App:      config.App{Locale: "en-GB", Timezone: "Europe/London"},
 		Database: config.Database{Path: "./data/myday.db"},
 		Secrets: config.Secrets{
-			SessionKey: good, CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
+			CookieSecret: good, CSRFKey: good, TOTPEncryptionKey: good,
 		},
 		Mail:       config.Mail{Host: "smtp.example.com", Port: 587, From: "myday@example.com"},
 		Modules:    map[string]bool{"time": true},

internal/core/setup/setup.go

@@ -376,7 +376,6 @@ func (a *Actions) generateSecrets(c *config.Config) (bool, error) {
 		dst  *string
 		n    int
 	}{
-		{"secrets.session_key", &c.Secrets.SessionKey, 32},
 		{"secrets.cookie_secret", &c.Secrets.CookieSecret, 32},
 		{"secrets.csrf_key", &c.Secrets.CSRFKey, 32},
 	} {