feat(obsidian-livesync): initial CouchDB LiveSync deployment

apps/obsidian-livesync/couchdb-secret.yaml.example

@@ -0,0 +1,22 @@
+# DO NOT COMMIT THE REAL VERSION OF THIS FILE.
+# apps/obsidian-livesync/couchdb-secret.yaml is gitignored — apply it manually once:
+#
+#   cp apps/obsidian-livesync/couchdb-secret.yaml.example apps/obsidian-livesync/couchdb-secret.yaml
+#   # fill in real values below, then:
+#   kubectl apply -f apps/obsidian-livesync/couchdb-secret.yaml
+#   kubectl annotate secret couchdb-secret -n obsidian \
+#     argocd.argoproj.io/sync-options=Prune=false --overwrite
+#
+# Generate strong values with:
+#   python3 -c "import secrets; print(secrets.token_urlsafe(18))"   # password
+#   python3 -c "import secrets; print(secrets.token_hex(32))"        # COUCHDB_SECRET
+apiVersion: v1
+kind: Secret
+metadata:
+  name: couchdb-secret
+  namespace: obsidian
+stringData:
+  COUCHDB_USER: "admin"
+  COUCHDB_PASSWORD: "CHANGE_ME"
+  # Erlang/OTP cookie — must be a long random hex string
+  COUCHDB_SECRET: "CHANGE_ME_HEX_32_BYTES"