Wraps openssl rand -hex 32 (with /dev/urandom fallback) so operators don't have to remember the incantation. Defaults to printing the secret; --write [path] sets/replaces CM_AUTH_SECRET in the target .env (./.env by default) and prints the restart command.