Add upgrade note for secret file loading

docs/guides/upgrading/v0.7.0.md

@@ -105,7 +105,6 @@
     | `alpine.database.url`               | `dt.datasource.url`                  |
     | `alpine.database.username`          | `dt.datasource.username`             |
     | `alpine.database.password`          | `dt.datasource.password`             |
-    | `alpine.database.password.file`     | `dt.datasource.password-file`        |
     | `alpine.database.pool.enabled`      | `dt.datasource.pool.enabled`         |
     | `alpine.database.pool.max.size`     | `dt.datasource.pool.max-size`        |
     | `alpine.database.pool.min.idle`     | `dt.datasource.pool.min-idle`        |
@@ -118,6 +117,22 @@
   * The new datasource configuration mechanism is documented in the
     [datasource configuration reference](../../reference/configuration/datasources.md).
 
+* **Loading secrets from files now uses the `${file::}` expression syntax.** The legacy
+  `<key>.file=/path` and `alpine.<key>.file=/path` properties are no longer recognized, and
+  the API server refuses to start if any of them are set. Rewrite each occurrence as
+  `<key>=${file::/path}`. Affected properties:
+
+    | Before                                                               | After                                   |
+    |:---------------------------------------------------------------------|:----------------------------------------|
+    | `dt.database.password.file` (or `alpine.database.password.file`)     | `dt.datasource.password=${file::/path}` |
+    | `dt.http.proxy.password.file` (or `alpine.http.proxy.password.file`) | `dt.http.proxy.password=${file::/path}` |
+    | `dt.ldap.bind.password.file` (or `alpine.ldap.bind.password.file`)   | `dt.ldap.bind.password=${file::/path}`  |
+
+    The file is read once at startup, decoded as UTF-8, and trailing whitespace is stripped.
+    Files larger than 64 KiB are rejected. Refer to
+    [Loading values from files](../../reference/configuration/application.md#loading-values-from-files)
+    for details.
+
 * **All configuration properties have been standardized to use the `dt.` prefix**.
   Properties that previously used the `alpine.` prefix, or no prefix at all, are now under `dt.`.
   For example:

docs/reference/configuration/application.md

@@ -36,6 +36,20 @@ dt.datasource.bar.url=${dt.datasource.foo.url}
 
 This is useful to avoid redundant definition of identical values.
 
+## Loading Values From Files
+
+Configuration values may be loaded from files using the `${file::/path/to/file}` expression. This is
+useful when secrets are mounted into the container as files, for example via Docker or Kubernetes
+secrets:
+
+```ini linenums="1"
+dt.datasource.password=${file::/var/run/secrets/database-password}
+dt.ldap.bind.password=${file::/var/run/secrets/ldap-bind-password}
+```
+
+The file is read once at startup, decoded as UTF-8, and trailing whitespace is stripped. Files
+larger than 64 KiB are rejected.
+
 ## Environment Variable Mapping
 
 The canonical representation of properties uses alphanumeric characters,