chore: import verified syly2 maintenance baseline without embedded credentials

config/secrets.example.properties

@@ -0,0 +1,15 @@
+# Copy outside the checkout/WAR; restrict permissions to the runtime user.
+# Set SYLY_SECRETS_FILE or -Dsyly.secrets.file=/absolute/private/path.
+# Preserve the existing keys for historical data and the existing RSA public key.
+SYLY_AES_KEY=
+SYLY_RSA_PRIVATE_KEY=
+SYLY_MAIL_HOST=
+SYLY_MAIL_SENDER=
+SYLY_MAIL_USER=
+SYLY_MAIL_PASSWORD=
+SYLY_SMS_ACCOUNT=
+SYLY_SMS_PASSWORD=
+# Optional manual diagnostic utilities only:
+SYLY_LDAP_TEST_PASSWORD=
+SYLY_TEST_DB_PASSWORD=
+SYLY_TEST_API_KEY=