Store the secret key file in a hidden file or folder

Problem/Motivation

In early conversations, the secret file was planned to live inside a hidden folder (e.g., `.drupal-keychain`). I'm unsure why this was simplified to a single `secret-file.php` file, but I want to revisit this decision. (A dedicated folder isn't necessary if we only plan to support one public/private key pair per site.)

Using a hidden file/folder (starting with `.`) offers some benefits:
- Follows Unix conventions for configuration files, making the purpose immediately recognizable to developers
- Hidden from directory listings by default (requires `ls -a`), reducing visibility and chance of accidental modifications

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes