chore: load secrets from config/system/secrets.php

additional.php is maintained in Git now (taken over from DDEV's
generated file): DDEV settings apply inside DDEV only, and
secrets.php (gitignored, template secrets.example.php) is merged in
everywhere, ignoring empty values. The web container reaches the local
MyE&P project as myep-next.ddev.site, as in EP/website.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

config/system/secrets.example.php

@@ -0,0 +1,25 @@
+<?php
+
+// Template for config/system/secrets.php (not in Git). Values come from the TYPO3 10
+// production LocalConfiguration.php; empty values are ignored.
+return [
+    'SYS' => [
+        // Must be the production key of TYPO3 10: static pages link to cHash URLs served by TYPO3 13
+        'encryptionKey' => '',
+    ],
+    'EXTENSIONS' => [
+        'ep_products' => [
+            // /api/hotel, /api/product, /api/content/* (X-Api-Key or ?key=)
+            'cmsApiKey' => '',
+            // MyE&P OAuth2 client credentials (import, price calendar); locally e.g. https://myep-next.ddev.site/api/
+            'myEpApiBaseUrl' => '',
+            'myEpApiClientId' => '',
+            'myEpApiClientSecret' => '',
+            'myEpApiUrlAuthorize' => '',
+            'myEpApiUrlToken' => '',
+            // bpn-connect (price calendar)
+            'bpnConnectApiBaseUrl' => '',
+            'bpnConnectApiKey' => '',
+        ],
+    ],
+];