- Remove MEMORY_API_KEY and CLAUDE_MEMORY_API_KEY from settings.json env block - Replace mcp.json inline config with wrapper script that sources GPG-encrypted secrets - Add new rotated key to encrypted secrets.zsh