Environments whose DB record was written before #258 can lack AUTH_SECRET in envConfig.secrets - the wizard generated it in memory and wrote it to a now-defunct non-vcs/secrets/ file but never persisted it. Resuming such an environment failed at the deployToFlyio pre-flight check with "missing required secrets [AUTH_SECRET]", forcing a destroy/recreate or a hand-backfill into the DB document.
resumeEnvironment now classifies missing REQUIRED_SECRETS before deploy:
AUTH_SECRET is auto-generated, persisted back to the environment record, and reported on the wizard progress stream, then the deploy proceeds.
Any other missing required secret (AWS_*, MONGODB_URI, NODE_ENV) throws fast with a message naming exactly what is missing and where to supply it.
secrets.ts: classifyMissingRequiredSecrets splits missing required secrets into autoGeneratable vs unrecoverable.
environments-config.ts: persistEnvironmentSecret deep-merges a single secret into one environment's secrets without touching the rest.
environment.ts: healMissingRequiredSecrets orchestrates the recovery.
secrets.spec.ts: unit tests for the classifier.