fix: update for main logic

README.md

@@ -15,7 +15,7 @@ RabbitMQ (crypto.transfer.requested)
                           └─ AmqpPublisher (crypto.transfer.completed)
 ```
 
-Postgres credentials and RabbitMQ credentials are pulled from HashiCorp Vault (KV v2, AppRole auth). The hot-wallet private key, ETH RPC URL and limits stay in `.env`.
+Postgres credentials and RabbitMQ credentials are pulled from HashiCorp Vault (KV v2, AppRole auth). The hot-wallet private key, ETH RPC URL and USDT contract can also be pulled from Vault via the optional `ethereum` secret; `.env` remains as a fallback for those fields and runtime limits.
 
 ## Message contract
 
@@ -66,7 +66,7 @@ Required `.env` (see `.env.example`):
 ```
 PORT=3000
 ETH_RPC_URL=https://ethereum-rpc.publicnode.com
-HOT_WALLET_PRIVATE_KEY=0x...
+HOT_WALLET_PRIVATE_KEY=
 USDT_CONTRACT_ADDRESS=0xdAC17F958D2ee523a2206206994597C13D831ec7
 
 VAULT_MOUNT_POINT=dev-secrets
@@ -107,11 +107,19 @@ WEBHOOK_TIMEOUT_MS=10000
 | user     | username      |
 | password | password      |
 
+Optional `dev-secrets/ethereum`:
+
+| key                    | value                    |
+|------------------------|--------------------------|
+| rpc_url                | Ethereum RPC URL         |
+| hot_wallet_private_key | company wallet private key |
+| usdt_contract_address  | USDT contract address    |
+
 ## HTTP
 
 A single endpoint is exposed for liveness/readiness probes:
 
-- `GET /health` — RPC block number + hot-wallet ETH/USDT balances. Returns 503 on RPC errors.
+- `GET /health` — RPC block number, hot-wallet ETH/USDT balances, Postgres ping and RabbitMQ connection state. Returns 503 if any dependency is degraded.
 
 ## Local development