docs(secrets): add new Concepts/Secrets doc about passing sensitive data to services, including x-command extension

website/docs/8-compose-file-reference/1-support-matrix.md

@@ -42,7 +42,7 @@ If you rely on a specific Compose feature that is not supported by Uncloud, plea
 | `ports`                          | ⚠️ Limited         | `mode: host` only, use [`x-ports`](2-extensions.md#x-ports) for HTTP/HTTPS                                                                 |
 | `privileged`                     | ✅ Supported        | Run containers in privileged mode                                                                                                          |
 | `pull_policy`                    | ✅ Supported        | `always`, `missing`, `never`                                                                                                               |
-| `secrets`                        | ❌ Not supported    | Use configs or environment variables                                                                                                       |
+| `secrets`                        | ⚠️ Limited         | Reference secrets in `environment`, see [Secrets](../3-concepts/8-secrets.md). File mounts not supported                                   |
 | `security_opt`                   | ❌ Not supported    |                                                                                                                                            |
 | `shm_size`                       | ✅ Supported        | Shared memory size                                                                                                                         |
 | `stop_grace_period`              | ✅ Supported        | Time to wait after SIGTERM before SIGKILL                                                                                                  |

website/docs/8-compose-file-reference/2-extensions.md

@@ -117,3 +117,23 @@ The hook container also gets `UNCLOUD_HOOK_PRE_DEPLOY=true` environment variable
 
 See [Pre-deploy hooks](../4-guides/1-deployments/5-pre-deploy-hooks.md) for more details, usage examples, and failure
 handling.
+
+## `secrets.*.x-command`
+
+Resolve a secret by running a command locally and using its output as the value. Define a secret under the top-level
+`secrets` section, then reference it as `secret://<name>` in a service's `environment`:
+
+```yaml
+services:
+  api:
+    image: myapp
+    environment:
+      DB_PASSWORD: secret://db_password
+
+secrets:
+  db_password:
+    # Read the secret value from 1Password by running this command locally.
+    x-command: op read "op://prod/myapp/db_password"
+```
+
+See [Secrets](../3-concepts/8-secrets.md) for more details and supported secret sources.