Secrets stay encrypted at rest; this page controls which seats can inject them and at what clearance.
This is an additive leadership surface inside the same dashboard/PWA shell. Seat lifecycle remains in Seats.
clearance ≥ 1 · all seats