Every DPoP-authenticated request and cloud health/mint call writes a
single-use marker to the secrets directory, and nothing ever removed
them. Proofs are only accepted for a few minutes, so sweep markers older
than an hour on startup and every ten minutes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1jWssjvT14xf2uw1daK7Z