feat(secrets): seal remaining user-provided cluster secrets

Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.

Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/nightscout/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - nightscout-configmap.yaml
+  - nightscout-sealedsecret.yaml
   - mongo-pvc.yaml
   - mongo-deployment.yaml
   - mongo-service.yaml

apps/nightscout/nightscout-sealedsecret.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: nightscout-secret
+  namespace: nightscout
+spec:
+  encryptedData:
+    API_SECRET: AgC0frB9Yx9u8pzIE1//OVLdEFaFZSAguSlosSF6ZcQg2sJrunqlxygNujo8LxPHv9YsT1Wwjcl7B0+4SVpqygkIAIN15dQiQX8QEYAytGkRv2nnG1q7jaW/m9S5D5EAIyFgzLHtO8zFCw6lO+e5Yt+qgEE7ZRN/eWEOK9LIYmIhVa7Pbc/xQoueqS2XxtHORhyLU3b74e4GEzb0HJDSDYq1LZfTqi1dnuxKTx0zNcFhQL/QM2W+kUhuZEM/eWpdQt4GBgRvNRT1CPUCeHw1Hf5veh38CxiByU3jYy1SA5q/GN5skgq7fEReKGpBLNIadgjt9516Mognt/f+C60E/VHxKyIWb9F6Lf0tJT9lRv2mU9bX3YykPHLzrVIZ/TdFQ/SDqZ6I2Lz5MOSIJWV5pTqPOvMBLNdzGLOx56kdolxBbwNYRAsELKwwlZnW27Kodc1PFgtFbfkwpoVGdnh3xdyFPQTBcUTyZHAMcproZAhMrcALdyT0rAvnNICFetvGsacT0gv+2c88UWvb1UZ0FYKcnQmUWKD5ou69Gspm2mr+izVt1dQPNa5wxLbRFF5pzong4Q/6hVA+VX1i8rR7/D0adaqdvPYOV36Wl80JLmGbgpilFnDTZP5IQV8kaIZqb94Y1YqOlkciAcO6eICQuXf923kigELB9CYPEUoQCOYWCGBFTFxLbIwq3dvQEjgDoNyR0P3D1mPhR6mCEt7n
+    MONGODB_URI: AgA9Wj9k2Tdq3UiZVSK8QBhxqxch4pMWDPzWVG/gRcSsAs0KNGiDfd3MINencnSPF5Qf6ChOdc1XXJVZg83H/no068nNev+qT11T/xs7cFNhFgagYzp5bd7i5vsxIC9f69GfGbtOie32phQtCQgjkjwv9seYFywbR6u6cuaBl0wcU/RJRfLEr+goGW3EEtV0yvqxMUeg574D/uL9TSs2uZ9/XGBWGrEzbwIQkyWpUKSn7BWlCxPLQn1s7yOVQsjCKiehzb5EyEkqXhhv2QKObHyIduETFcx+8Pw40QCLVL4IXaAIV//gxDxPJPRbJ+3kL09sWW1ZdnLyvu6Tf7S228MA7uswq3Qe67q/s3vm31+ujnjGugmFtABRVAwvvmC44r79PtrRatMzeRaqMWAJSb+aGv0vxCBifA2qK/mGMIkniSFK0ciV19+Bv6m4L8IB4B4Vn1ookYjcyp0YiSqTJo2c5gMaCHqfwIS6F53+RBod0iQHByLpELgYx9h7qwoNsbFqFTDQLPk8qH1tBoJO3b1vp6FWIFLlkHbuJLfA8hBnWDEEvKoSbVjiDwyusW6duJ3CF4F0WugtfUtg8YVffR1RllUczzPgie1MCl1eZaY9ro86W1+vMC9SRyewIPTUxi64Xpmv4LtXdqdcBctSw3SxWz0ITjVk2pOgDFDOxYYRpngAiLk+8FGRzKiWM175L1E/LyjQsdsNrwwfhWjkaYQbHyelBBh/R5EJTIx2aqLL7hY6
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/managed: "true"
+      name: nightscout-secret
+      namespace: nightscout
+    type: Opaque