One token, zero scopes, and the .env I clobbered

Setting a single environment variable on a crawler meant picking a token with no permissions, and accidentally overwriting the .env I was only trying to read. Why secrets belong in a vault instead of a file, and how the logicsrc CLI does it.