feat(chore): impelmented seecret generation

scripts/generate-secrets.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Generates random values for the secrets docker-compose.yml requires
+# (LITELLM_MASTER_KEY, LITELLM_SALT_KEY, LITELLM_DB_PASSWORD) and writes
+# them into .env — creating it from .env.example first if it doesn't exist.
+#
+# ponytail: only fills in blank values, never overwrites ones you've already
+# set — safe to re-run. Re-running won't touch LITELLM_SALT_KEY once it's
+# set; changing it after first run makes existing encrypted data unreadable.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+[ -f .env ] || cp .env.example .env
+
+set_if_blank() {
+  local key="$1" value="$2"
+  if grep -qE "^${key}=.*[^[:space:]]" .env; then
+    echo "${key}: already set, skipping."
+  else
+    sed -i "s|^${key}=.*|${key}=${value}|" .env
+    echo "${key}: generated."
+  fi
+}
+
+set_if_blank LITELLM_MASTER_KEY "$(openssl rand -hex 32)"
+set_if_blank LITELLM_SALT_KEY "$(openssl rand -hex 32)"
+set_if_blank LITELLM_DB_PASSWORD "$(openssl rand -hex 32)"
+
+echo "Done. Review .env, then set OPENWEBUI_LITELLM_KEY per docs/proxy-key-onboarding.md."