[ci skip] more codex 5.3 improvements

README.md

@@ -58,10 +58,12 @@ vctp -settings /path/to/vctp.yml -db-cleanup
 ```
 
 ## Database Configuration
-By default the app uses SQLite and creates/opens `db.sqlite3`. You can opt into PostgreSQL
-by updating the settings file:
+By default the app uses SQLite and creates/opens `db.sqlite3`.
 
-- `settings.database_driver`: `sqlite` (default) or `postgres`
+PostgreSQL support is currently **experimental** and not a production target. To enable it,
+set `VCTP_ENABLE_EXPERIMENTAL_POSTGRES=1` and update the settings file:
+
+- `settings.database_driver`: `sqlite` (default) or `postgres` (experimental)
 - `settings.database_url`: SQLite file path/DSN or PostgreSQL DSN
 
 Examples:
@@ -104,14 +106,19 @@ HTTP/TLS:
 
 vCenter:
 - `settings.vcenter_username`: vCenter username
-- `settings.vcenter_password`: vCenter password (encrypted at startup)
+- `settings.vcenter_password`: vCenter password (auto-encrypted on startup if plaintext length > 2)
 - `settings.vcenter_insecure`: `true` to skip TLS verification
-- `settings.vcenter_event_polling_seconds`: event polling interval (0 disables)
-- `settings.vcenter_inventory_polling_seconds`: inventory polling interval (0 disables)
+- `settings.vcenter_event_polling_seconds`: deprecated and ignored
+- `settings.vcenter_inventory_polling_seconds`: deprecated and ignored
 - `settings.vcenter_inventory_snapshot_seconds`: hourly snapshot cadence (seconds)
 - `settings.vcenter_inventory_aggregate_seconds`: daily aggregation cadence (seconds)
 - `settings.vcenter_addresses`: list of vCenter SDK URLs to monitor
 
+Credential encryption:
+- `VCTP_ENCRYPTION_KEY`: optional environment variable used to derive the encryption key.
+  If unset, vCTP derives a host key from hardware/host identity.
+- New encrypted values are written with `enc:v1:` prefix.
+
 Snapshots:
 - `settings.hourly_snapshot_concurrency`: max concurrent vCenter snapshots (0 = unlimited)
 - `settings.hourly_snapshot_max_age_days`: retention for hourly tables