Integrate with docker secrets

https://docs.docker.com/reference/compose-file/secrets/

The secrets should be provided as env vars to ssh kit, similar to this example:

require 'sshkit'
require 'sshkit/dsl'

# Assume you have your secrets loaded in your Ruby process
secret_value = ENV['MY_LOCAL_DB_PASSWORD'] || "super_secret_value"

on hosts do |host|
  # 1. Upload the generated docker-compose.yml (It contains no secrets!)
  upload! StringIO.new(generated_yaml_content), "/opt/app/docker-compose.yml"

  # 2. Run Docker Compose with the secret injected into the process environment
  #    SSHKit handles the export/unset logic for you securely.
  with RUBY_DEPLOY_DB_PASSWORD: secret_value do
    within "/opt/app" do
      execute :docker, :compose, :up, "-d"
    end
  end
end