GlobalConfig and its nested types all have Clone dependencies, so
Arc<GlobalConfig> was unnecessary. Also reverts the get_secret handler
to the simpler reveal()? style with Ok(...).

diff --git a/quire-server/src/quire/mod.rs b/quire-server/src/quire/mod.rs
index 600a5db..bd6d796 100644
--- a/quire-server/src/quire/mod.rs
+++ b/quire-server/src/quire/mod.rs
@@ -14,7 +14,7 @@ use quire_core::secret::SecretString;
 /// Parsed global configuration (`/var/quire/config.fnl`).
 ///
 /// Top-level stays open for future keys (notifications defaults, SMTP, etc.).
-#[derive(serde::Deserialize, Debug)]
+#[derive(serde::Deserialize, Debug, Clone)]
 #[serde(rename_all = "kebab-case")]
 pub struct GlobalConfig {
     #[serde(default)]
@@ -60,7 +60,7 @@ impl GlobalConfig {
 }
 
 /// Global GitHub integration configuration.
-#[derive(serde::Deserialize, Debug, Default)]
+#[derive(serde::Deserialize, Debug, Default, Clone)]
 #[serde(rename_all = "kebab-case")]
 pub struct GlobalGithubConfig {
     /// Bearer token used to authenticate push access to the mirror remote.
@@ -72,7 +72,7 @@ fn default_port() -> u16 {
     3000
 }
 
-#[derive(serde::Deserialize, Debug, Default)]
+#[derive(serde::Deserialize, Debug, Default, Clone)]
 pub struct CiConfig {
     /// How the orchestrator dispatches CI runs. Defaults to shelling
     /// out to the `quire-ci` binary via `Executor::Process`.
@@ -232,7 +232,7 @@ pub struct RepoGithubConfig {
 #[derive(Clone)]
 pub struct Quire {
     base_dir: PathBuf,
-    config: Arc<GlobalConfig>,
+    config: GlobalConfig,
     db_pool: Arc<OnceLock<Mutex<rusqlite::Connection>>>,
 }
 
@@ -256,7 +256,7 @@ impl Quire {
     pub fn new(base_dir: PathBuf, config: GlobalConfig) -> Self {
         Self {
             base_dir,
-            config: Arc::new(config),
+            config,
             db_pool: Arc::new(OnceLock::new()),
         }
     }
diff --git a/quire-server/src/quire/web/api.rs b/quire-server/src/quire/web/api.rs
index 39f3ce3..9c2d9d8 100644
--- a/quire-server/src/quire/web/api.rs
+++ b/quire-server/src/quire/web/api.rs
@@ -216,14 +216,13 @@ async fn get_secret(
     AxumPath(SecretPath { name }): AxumPath<SecretPath>,
 ) -> Result<axum::Json<serde_json::Value>, ApiError> {
     let value = tokio::task::spawn_blocking(move || -> std::result::Result<String, ApiError> {
-        quire
+        Ok(quire
             .global_config()
             .secrets
             .get(&name)
             .ok_or(ApiError::NotFound)?
-            .reveal()
-            .map(|s| s.to_string())
-            .map_err(ApiError::Secret)
+            .reveal()?
+            .to_string())
     })
     .await
     .expect("blocking task panicked")?;