feat(notesnook): manage secret via SealedSecret

Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of
hand-applied out-of-band, closing the config-DR gap the backups intentionally
don't cover. Existing Secret adopted via the managed annotation (values verified
unchanged). Controller private key backed up GPG-encrypted off-cluster.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

argocd/notesnook.yaml

@@ -12,13 +12,6 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: notesnook
-  ignoreDifferences:
-    - group: ""
-      kind: Secret
-      name: notesnook-secret
-      namespace: notesnook
-      jsonPointers:
-        - /data
   syncPolicy:
     automated:
       prune: true