stamp-monitor: take the admin token from a swarm secret

The ${STAMP_MONITOR_ADMIN_TOKEN} form rendered correctly under `docker
stack config` -- ADMIN_TOKEN: len=64 -- and still deployed with an EMPTY
value, twice, on a shell that had the variable exported. The result is a
service that starts, polls, alerts and serves its dashboard while every
admin route returns 503: it looks healthy and can show nothing.

A secret is mounted as a file, so there is no substitution left to
silently resolve to "". Same shape the homelab monitor already uses.

Create it once on the host:
  printf %s "$TOKEN" | docker secret create stamp_monitor_admin_token -

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YLYiaPYror1vLKApYKrxTu

hostinger/prod-stack.yaml

@@ -20,6 +20,11 @@ volumes:
     driver: local
 
 
+secrets:
+  stamp_monitor_admin_token:
+    external: true
+
+
 services:
 
   # Watches this node's postage batches and renews them before they lapse.
@@ -38,12 +43,20 @@ services:
     networks: [internal, public]
     volumes:
       - stamp-monitor-data:/data
+    secrets:
+      - stamp_monitor_admin_token
     env_file:
       - .env
     environment:
       BEE_URL: http://bee:1633
       DB_PATH: /data/monitor.sqlite
-      ADMIN_TOKEN: '${STAMP_MONITOR_ADMIN_TOKEN}'
+      # Read from a swarm secret, not an interpolated env var. The
+      # ${STAMP_MONITOR_ADMIN_TOKEN} form rendered correctly under `docker
+      # stack config` and still deployed EMPTY, which disables the admin API
+      # (503) while the service otherwise looks healthy — a dashboard that
+      # loads and can show nothing. A secret is mounted as a file and needs no
+      # substitution, so there is nothing left to silently resolve to "".
+      ADMIN_TOKEN_FILE: /run/secrets/stamp_monitor_admin_token
       # Armed: the whole point is that nothing renewed the batch last time.
       AUTO_TOPUP_ENABLED: "true"
       DRY_RUN: "false"