audit fixes: error handling, docs consistency, bucket idempotency

ARCHITECTURE.md

@@ -31,6 +31,11 @@ The `bws` CLI fetches secrets using machine account access tokens.
 - `hantim-deploy-ssh-public-key` -- deploy user SSH public key
 - `hantim-new-app-script` -- Gitea API token for creating repos
 - `hantim-vultr-api-key` -- Vultr API key for DNS management
+- `hantim-garage-rpc-secret` -- Garage cluster RPC secret
+- `hantim-garage-argento-node-id` -- Argento's Garage node ID + address
+- `hantim-garage-admin-token` -- Garage admin API token
+- `hantim-garage-media-key-id` -- S3 access key ID for media uploads
+- `hantim-garage-media-secret-key` -- S3 secret key for media uploads
 
 Machine accounts:
 - `hantim-server` -- used by `bootstrap.sh` and `configure.sh` on the server
@@ -69,7 +74,9 @@ docker/nginx/                     # nginx reverse proxy
 docker/<domain>/compose.yml       # Per-app compose files
 docker/garage/                    # Garage S3-compatible object storage
   compose.yml
-  garage.toml.template
+  Dockerfile
+  garage.toml
+  .env.keys
 .gitea/workflows/deploy-<app>.yml # Per-app deploy workflows
 .gitea/workflows/provision.yml    # Triggers configure.sh on setup changes
 ```