feat(notesnook): manage secret via SealedSecret

Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of
hand-applied out-of-band, closing the config-DR gap the backups intentionally
don't cover. Existing Secret adopted via the managed annotation (values verified
unchanged). Controller private key backed up GPG-encrypted off-cluster.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/notesnook/kustomization.yaml

@@ -4,6 +4,7 @@ namespace: notesnook
 resources:
   - namespace.yaml
   - notesnook-config.yaml
+  - notesnook-sealedsecret.yaml
   - db-service.yaml
   - db-statefulset.yaml
   - db-init-job.yaml