feat(secrets): seal remaining user-provided cluster secrets

Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.

Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/nightscout/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - nightscout-configmap.yaml
+  - nightscout-sealedsecret.yaml
   - mongo-pvc.yaml
   - mongo-deployment.yaml
   - mongo-service.yaml