修改配置编辑不了的问题

scripts/check-ack-manifests.mjs

@@ -39,7 +39,8 @@ assert(goApi.includes("name: zhinian-go-runtime"), "Go API must consume the Go r
 assert(goApi.includes("name: zhinian-go-auth"), "Go API must own the browser session signing Secret");
 assert(!goApi.includes("name: zhinian-web-auth"), "Go API must not reference the removed Web auth Secret");
 assert(goApi.includes("name: zhinian-go-bootstrap"), "Go API must receive bootstrap administrator credentials");
-assert(goApi.includes("name: zhinian-go-providers"), "Go API must receive real provider credentials");
+assert(goApi.includes("name: zhinian-go-providers"), "Go API must accept provider environment fallbacks");
+assert(goApi.includes("optional: true"), "Provider fallback Secret must be optional when settings are stored in PostgreSQL");
 assert(!goApi.includes("rds-ca"), "Go API must not mount an RDS CA when PostgreSQL TLS is disabled");
 assert(!goApi.includes("/etc/zhinian/rds"), "Go API must not retain the removed RDS CA path");
 assert(!/\bTLS\b/i.test(goApi), "Go API manifest must not retain PostgreSQL TLS configuration");
@@ -48,7 +49,7 @@ assert(!goApi.includes("DATABASE_CA_CERT_PATH"), "Go API must not receive a data
 
 const secrets = read("secrets.example.yaml");
 assert(secrets.includes("name: zhinian-go-auth"), "Example secrets must name Go as the session Secret owner");
-assert(secrets.includes("name: zhinian-go-providers"), "Example secrets must define real provider credentials");
+assert(secrets.includes("name: zhinian-go-providers"), "Example secrets must define optional provider environment fallbacks");
 assert(!secrets.includes("name: zhinian-web-auth"), "Example secrets must not retain the removed Web auth Secret");
 assert(!secrets.includes("zhinian-rds-ca"), "Example secrets must not define the removed RDS CA Secret");
 assert(!secrets.includes("sslrootcert"), "Example DATABASE_URL values must not reference an RDS CA");