migrate-config

Migrate .env-only configuration to split secrets/config format