Inject secrets from files into env vars at runtime - no plaintext passwords