Set up 1Password CLI for secrets management

[jbold]

Goal

Integrate 1Password CLI (op) for managing bot tokens, API keys, and other secrets instead of storing them in plaintext config files or env vars.

Context

• Currently Discord bot token and other secrets go directly in openclaw.json or env vars
• Our DevSecOps rules say: no plaintext secrets in prod, use Podman secrets or 1Password CLI
• 1Password CLI can inject secrets at runtime via op run

Tasks

• Install and configure 1Password CLI
• Store Discord bot token, gateway token, and other secrets in 1Password vault
• Update systemd unit to use op run for secret injection
• Document the pattern for future secrets

References

• OpenClaw 1Password skill: skills/1password/SKILL.md
• Related: Discord channel integration — primary work interface #6 (Discord setup)