Clarify secrets: startup vs endpoint access, and Serverpod Cloud

[developerjamiu]

Demand

Part of the Kapa "Secrets & Seeding" cluster — 15 conversations / 15 users.

Problem

• The docs do not distinguish pod.getPassword() (available at server startup) from session.passwords[...] (used inside endpoints) — users ask things like "can I use pod.getPassword in Flutter?".
• No guidance on managing secrets on Serverpod Cloud (the managed environment), or where credential files like google_client_secret.json / firebase_service_account_key.json should live.
• No production storage / gitignore guidance.

Scope

• 07-configuration.md: an explicit startup-vs-endpoint note.
• Deployment docs: a "Secrets on Serverpod Cloud" section.
• Production storage / gitignore guidance.

Verify before writing

• The recommended secret-loading approach on Serverpod Cloud (confirm with the team).