ArcadiaCloud.Guardian had no secret_key for prod at all — every authed route
would fail at deploy. Wire it from GUARDIAN_SECRET_KEY, raising when absent in
prod; keep the pinned dev/staging default.
Ecosystem audit 2026-06-20, rank 2 blocker.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>