fix(k8s): extract Secret to separate file to fix kustomize apply

- Move ENCRYPTION_KEY Secret from gitea-assistant.yaml to k8s/secret.yaml
- Add secret.yaml to kustomization.yaml resources
- Update deployment docs with secret creation step

k8s/gitea-assistant.yaml

@@ -1,18 +1,3 @@
----
-# Secret: sensitive configuration (create before deploying)
-# Generate a 64-char hex key: openssl rand -hex 32
-apiVersion: v1
-kind: Secret
-metadata:
-  name: gitea-assistant-secret
-  namespace: gitea-assistant
-  labels:
-    app.kubernetes.io/name: gitea-assistant
-    app.kubernetes.io/part-of: gitea-assistant
-type: Opaque
-stringData:
-  ENCRYPTION_KEY: "" # REQUIRED: run `openssl rand -hex 32` and paste here
-
 ---
 # ConfigMap: only infrastructure-level env vars that must be known before DB init
 apiVersion: v1

k8s/kustomization.yaml

@@ -5,5 +5,6 @@ namespace: gitea-assistant
 
 resources:
   - namespace.yaml
+  - secret.yaml
   - qdrant.yaml
   - gitea-assistant.yaml

k8s/secret.yaml

@@ -0,0 +1,13 @@
+# IMPORTANT: Fill in ENCRYPTION_KEY before running kubectl apply -k k8s/
+# Generate a key:  openssl rand -hex 32
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-assistant-secret
+  namespace: gitea-assistant
+  labels:
+    app.kubernetes.io/name: gitea-assistant
+    app.kubernetes.io/part-of: gitea-assistant
+type: Opaque
+stringData:
+  ENCRYPTION_KEY: "" # REQUIRED: paste your key here