`STELLAR_GATEWAY_SECRET` is loaded but never used — no signing/refund path

[Darkdruce]

Summary

gateway_secret is read, stored, and redacted in Debug, but is referenced nowhere else in the codebase.

Location

• src/config.rs:115 (read) — grep gateway_secret src/ shows no consumer outside config.rs.

Details & impact

The service never signs or submits any Stellar transaction, so:

• overpayment refunds documented in the README/horizon.rs policy cannot actually be performed by the gateway, and
• operators are asked to mount a live wallet secret into a process that has no use for it, needlessly widening the blast radius of a compromise.

Suggested fix

Either implement the outbound/refund path that needs the secret, or remove the variable and stop requesting it. Document the decision.

Acceptance criteria

• The secret is either used by an implemented feature or removed from config and docs.

[Haroldwonder]

Hi. I'd love to try this

[grantfox-oss]

🦊 GrantFox — @Haroldwonder has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #75)
2. Your PR will be reviewed by the StellarGateLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@Haroldwonder's PR #203 was approved and merged by @Manuel1234477.

🏆 @Haroldwonder: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (694 total points). Track your full progress on GrantFox.

👏 Great work, @Haroldwonder! Keep contributing to StellarGateLabs.