Extends both the `kubernetes` and `machine` profiles so that `charmcraft init` scaffolds a charm that handles Juju secrets from both sides, with unit and integration tests for it. The profile is a strong signal to human and agentic charmers for best practices. Secrets are a good candidate for that signal because they are easy to get half-right: reading an observed secret once on `config-changed` looks correct until the operator adds a new revision and nothing happens, and rotating an owned secret looks correct until revisions pile up because nothing removes them. Both failures are silent, so the profile handles the full event set rather than the two events that are enough for a demo. A charm also meets secrets in two roles that need different code — it observes secrets an operator grants it, and it owns secrets it generates for its workload. A charm author who has only seen one usually writes the other incorrectly. ### Changes Both profiles in `charmcraft.yaml.j2`: Adds an `api-token` config option of `type: secret`, with a description giving the operator the three commands they need (`juju add-secret`, `juju grant-secret`, `juju config`). In both profiles, the observed secret: `config-changed` and `secret-changed` share one `_configure_api_token()`, which fetches with `model.get_secret(id=..., label=API_TOKEN_LABEL)` and reads with `get_content(refresh=True)`. Attaching the label is what lets the `secret-changed` handler recognise the secret, since the event carries the label rather than the config value. A secret that isn't granted, or has gone away, leaves the unit blocked. In both profiles, the app-managed secret: The leader creates a workload password on `start` (machine) or `pebble-ready` (kubernetes), with monthly rotation and a 90 day expiry; creation is looked up by label first, so it's idempotent. `secret-rotate` and `secret-expired` both add a new revision — expiry doesn't remove the expiring revision, because that's the latest one and other units may still be reading it. `secret-remove` does the cleanup, once Juju reports that no unit is tracking a revision. --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/charmcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [ ] ~I've added or updated any relevant documentation.~ - [ ] ~In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing.~ - [x] I've updated the relevant release notes.