Protect API keys and secrets for OpenClaw. Credentials stay in your vault, never in the agent's memory