feat: sanitized agent config — Nexus no longer reads secrets from openclaw.json

- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json
- Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json
- Add AgentConfigPath env var to compose for explicit path configuration
- Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction
- Add agents-sanitized.json to .gitignore

Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors
on the Board endpoint when lost.

.gitea/scripts/deploy-nexus.sh

@@ -106,6 +106,28 @@ git archive --format=tar HEAD | docker run --rm -i \
     chown -R "$dest_owner" /dest
   '
 
+# ── Sanitized agents config for Nexus (no secrets) ──
+echo "Generating sanitized agents config for Nexus"
+AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json"
+OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
+if [ -f "$OPENCLAW_CONFIG" ]; then
+  python3 -c "
+import json, sys
+with open('$OPENCLAW_CONFIG') as f:
+    data = json.load(f)
+agents = data.get('agents')
+if agents is None:
+    print('ERROR: \"agents\" key not found in openclaw.json', file=sys.stderr)
+    sys.exit(1)
+with open('$AGENTS_SANITIZED_PATH', 'w') as f:
+    json.dump({'agents': agents}, f, indent=2)
+"
+  chmod 644 "$AGENTS_SANITIZED_PATH" 2>/dev/null || true
+  echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
+else
+  echo "WARNING: openclaw.json not found at $OPENCLAW_CONFIG — agents-sanitized.json NOT generated" >&2
+fi
+
 echo "Building and starting Docker compose stack"
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \