Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.
Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Alex