docs: PORTAL_KEK env var (key encryption at rest)

README.md

@@ -46,6 +46,7 @@ LibreChat ──→ Member Portal ──→ LiteLLM ──→ backend
 | `LITELLM_BASE` | LiteLLM gateway URL |
 | `LITELLM_MASTER_KEY` | LiteLLM master key |
 | `OPENCOLLECTIVE_WEBHOOK_SECRET` | Optional webhook signature secret |
+| `PORTAL_KEK` | **Required.** Base64-encoded 32-byte key-encryption key. Member chat keys (`members.key_token`) are stored AES-256-GCM-encrypted at rest (`enc1:` prefix) and decrypted in memory only when served (dashboard, LibreChat key feed, LiteLLM management). Generate with `python3 -c "import base64,os;print(base64.b64encode(os.urandom(32)).decode())"`. If unset, the portal runs but refuses to encrypt new keys, keeps legacy plaintext, and logs CRITICAL. Rotating it requires re-encrypting every row (decrypt with the old key, encrypt with the new). |
 
 ## Tier budgets