Introduces a new optional config variable that accepts a comma-separated list of previous APP_SECRET values. This is the first step toward supporting safe APP_SECRET rotation without invalidating existing tokens. https://claude.ai/code/session_0188Xia7v1AtRPe7LULjVrYF