meteor-accounts: oauth-services.md claims oauth-encryption seals a generic users.services.<provider>.secret field

[hexsprite]

skills/meteor-accounts/references/oauth-services.md says, right after the Accounts.config({ oauthSecretKey }) example:

After this, the OAuth secret field stored in Meteor.users.services.<provider> is ciphertext.

Meteor does not create a generic secret field on the user document. accounts-oauth seals the provider application secret in ServiceConfiguration.configurations.secret, and the provider packages seal their own user token fields (accessToken, refreshToken, idToken where present). See packages/accounts-oauth/oauth_server.js and packages/oauth-encryption.

The same repo already states this correctly in skills/meteor-accounts/SKILL.md ("To encrypt OAuth secrets at rest" paragraph) and in skills/meteor-security/SKILL.md, so the reference file contradicts its own skill. An agent reading the reference will look for, or worse write to, a field that does not exist.

Suggested replacement for the sentence:

After this, oauth-encryption seals the provider application secret in ServiceConfiguration.configurations.secret and the provider-specific user token fields (for example accessToken and refreshToken under Meteor.users.services.<provider>). It does not add a generic secret field to the user document.

Found by a code reviewer while vendoring these skills into a project.