ML service secrets: config is not code

ML services usually need keys, endpoints, model names, and sometimes tenant IDs. Those values belong in environment configuration, not in committed source code.

The practical rule is simple: code can name the secret it needs, but it should not contain the secret value. Logs should redact key-like values too.

This lesson keeps the values fake, but the checks are real: required keys, missing config, and safe display.