chore: capture Jenkins Docker baseline

scripts/setup-secrets.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Generates the SSH keypair (controller -> agents) and the Jenkins admin
+# password consumed by docker-compose.yml as Docker secrets. Safe to re-run;
+# it skips anything that already exists.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+mkdir -p secrets
+
+if [ ! -f secrets/agent_ssh_key ]; then
+    ssh-keygen -t ed25519 -f secrets/agent_ssh_key -N "" -C "jenkins-agent"
+    echo "Generated secrets/agent_ssh_key(.pub)"
+else
+    echo "secrets/agent_ssh_key already exists, skipping"
+fi
+
+if [ ! -f secrets/jenkins_admin_password.txt ]; then
+    openssl rand -base64 18 > secrets/jenkins_admin_password.txt
+    echo "Generated Jenkins admin password (saved to secrets/jenkins_admin_password.txt):"
+    cat secrets/jenkins_admin_password.txt
+else
+    echo "secrets/jenkins_admin_password.txt already exists, skipping"
+fi