move xfay app secret to .env

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/file_upload_integration_test.dart

@@ -6,28 +6,29 @@ import 'dart:typed_data';
 import 'package:swarm/swarm.dart';
 import 'package:test/test.dart';
 
+import 'test_env.dart';
+
 // Well-known test key — obviously not a real user key.
 const _privKey =
     '0000000000000000000000000000000000000000000000000000000000000001';
 
-// Per-app credentials for the xfay app.
-// ignore: avoid_hardcoded_credentials (test-only, not a user secret)
 const _kAppName = 'xfay';
-const _kAppSecret =
-    'REDACTED';
 
 // Minimal valid JPEG (SOI marker only — enough for R2 to store).
 final _kTestBytes = Uint8List.fromList([0xFF, 0xD8, 0xFF, 0xD9]);
 const _kContentType = 'image/jpeg';
 
 void main() {
+  final env = loadEnv();
+  final appSecret = env['XFAY_APP_SECRET'] ?? '';
+
   late FileUploadActor actor;
 
   setUp(() {
     actor = FileUploadActor(
       privateKey: _privKey,
       appName: _kAppName,
-      appSecret: _kAppSecret,
+      appSecret: appSecret,
     );
   });