Add SOMA_KEY_SECRET to Secret Manager and wire it into Cloud Run

Creates soma-key-secret in GCP Secret Manager for HMAC key signing, and
adds SOMA_KEY_SECRET + SOMA_BASE_DOMAIN env vars to the soma-prod-us Cloud
Run service so stateless API key validation works in production.

servers/gcp/cloud-run-soma.tf

@@ -138,6 +138,21 @@ resource "google_secret_manager_secret_version" "soma_node_secret" {
   secret_data = "a3f8d2e1c4b5a6978f0e3d2c1b4a5978f"
 }
 
+resource "google_secret_manager_secret" "soma_key_secret" {
+  secret_id = "soma-key-secret"
+  project   = var.project_id
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "soma_key_secret" {
+  secret      = google_secret_manager_secret.soma_key_secret.id
+  # HMAC signing secret for stateless API keys — rotate after first deploy
+  secret_data = "neuron-soma-key-secret-2026-change-me"
+}
+
 # ── Cloud Run Service — us-central1 ──────────────────────────────────────────
 
 resource "google_cloud_run_v2_service" "soma_us" {
@@ -203,6 +218,21 @@ resource "google_cloud_run_v2_service" "soma_us" {
         }
       }
 
+      env {
+        name  = "SOMA_BASE_DOMAIN"
+        value = "neurontechnologies.ai"
+      }
+
+      env {
+        name = "SOMA_KEY_SECRET"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.soma_key_secret.secret_id
+            version = "latest"
+          }
+        }
+      }
+
       env {
         name  = "GCP_PROJECT_ID"
         value = var.project_id
@@ -260,6 +290,7 @@ resource "google_cloud_run_v2_service" "soma_us" {
     google_secret_manager_secret_version.soma_hf_token,
     google_secret_manager_secret_version.soma_operator_key,
     google_secret_manager_secret_version.soma_node_secret,
+    google_secret_manager_secret_version.soma_key_secret,
   ]
 }