Use 1Password service accounts for automation, not shared logins

A practical pattern for using 1Password service accounts in automation: scope vault access, store item references, and handle rotation and revocation cleanly.