adventurelog: mark SECRET_KEY as data_key (fail-closed restore annotation)

SECRET_KEY ("Titkosítási kulcs") is a data-encrypting key — regenerating it on
restore would render stored data unreadable. data_key:true makes the controller
recover it from the guest's own app.yaml (live/PBS) and fail closed if it can't,
rather than ever regenerating. Pairs with controller v0.53.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/adventurelog/.felhom.yml

@@ -37,6 +37,11 @@ deploy_fields:
     type: secret
     generate: "hex:32"
     locked_after_deploy: true
+    # Data-encrypting key: the app secures stored data with it, so it must NOT be regenerated on
+    # restore (that would render restored data unreadable). The recovery unit stays secret-free; at
+    # restore the controller recovers this key from the guest's own app.yaml (live, or via the PBS
+    # whole-guest snapshot) and FAILS CLOSED (refuse + warn) if it cannot — never silently restores.
+    data_key: true
 
   - env_var: DB_PASSWORD
     label: "Adatbázis jelszó"