claude
beaa24754c
mavcaldav took -pass and -render-pass as flag values, so enabling it would have put his calendar password in `ps` inside the container, in the compose file, and in shell history. mavpoll and mavmaild both read their secret from a file for exactly that reason. readSecret reads once at start, trims, and refuses an empty or missing file. An empty file is a deployment mistake, not a password, and basic auth would otherwise send "" and collect a 401 every poll. A rotated password means a restart, which is cheaper than re-reading the credential every five minutes. Nothing called the old flags: no compose service, no systemd unit, no test. So they are replaced rather than kept beside the new ones.