[stackptr]

This gives Open WebUI its own oMLX sub-key.

The old key was shared with aichat and opencode. Its value sat in aichat-env and opencode-env, which the retired home key, also held by lobtop, could decrypt. stackptr/rc#703 gave those two consumers new keys. This PR rotates the remaining consumer, which is what allows the old key to be deleted in oMLX.

What changed

• In hosts/glyph/secrets/open-webui-env.age, the oMLX entry in OPENAI_API_KEYS is a new open-webui sub-key. The other variables are unchanged.
• I checked the file's header: it's encrypted to glyph and both YubiKeys only.
• Two things in open-webui.nix apply the new key on deploy:
  • ENABLE_PERSISTENT_CONFIG = "False", so the env file takes precedence over the connection stored in the database.
  • restartTriggers on the file, so deploying glyph restarts Open WebUI.

After merging

1. Deploy glyph. That also applies chore: rotate oMLX sub-keys, drop orphaned Anthropic key #703.
2. Send a chat to Qwen 3.8 27B at chat.zx.dev, and check opencode-web on glyph.
3. Delete the old shared sub-key in oMLX.

---

Generated by Claude Code