security: restore old public key in .sops.yaml for cluster decryption

Keep both public keys in .sops.yaml:
- Old key: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  (existing cluster secrets are encrypted with this)
- New key: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
  (new secrets will be encrypted with this)

Private keys remain secure in cluster (sops-age secret).
Public key history cleaned from git (see prior commits).

.sops.yaml

@@ -1,17 +1,21 @@
 # SOPS Configuration for secrets encryption
-# Public key is safe to commit; private key stays in cluster
+# Public keys are safe to commit; private keys stay in cluster
 
 creation_rules:
   # Encrypt secrets, configs, and sensitive files
-  # Public AGE key - safe to share and commit
+  # Multiple public keys for key rotation support
   # Files matching these patterns will be encrypted automatically with `sops -e`
   - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'  # Only encrypt data fields, keep structure readable
 
   # Fallback rule for .enc.yaml files
   - path_regex: '.*\.enc\.ya?ml'
-    age: age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
+    age:
+      - age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+      - age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
     encrypted_regex: '^data|^stringData'
 
 # To encrypt a file locally:
@@ -23,5 +27,8 @@ creation_rules:
 # To decrypt to stdout:
 #   sops --decrypt k8s/configmap.yaml
 #
-# The private age key is stored in the cluster at:
+# The private age keys are stored in the cluster at:
 #   kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
+#
+# Key rotation: Multiple public keys can coexist for decryption
+# Only private keys MUST be kept secret (in cluster only)

k8s/configmap.yaml

@@ -17,7 +17,7 @@ sops:
             SXB2b2wrZlVCeUhXaG5QQkxWQXJ6aDgKqV2V1jyeKQHr1iDaWR36WZWZdkZeSUcw
             BcA8vT73qdIb3Rnt6zYIBfgFYuVgQp4m+2pU3J4xgyGKPwQEtLz2XA==
             -----END AGE ENCRYPTED FILE-----
-          recipient: ***REMOVED***
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^data
     lastmodified: "2026-09-12T23:58:01Z"
     mac: ENC[AES256_GCM,data:4zterh5GOq6fibw+npmmIB//+7nYoKoQDXoinNCbTEAiQPuxqcpYJn1Mxmt37ZobG8Y7rqQYEpoRLCangFZA2b7mbkEWeEf9qXhP+cufqWB+Aagr7b8XmbL6tNSRxamxr+4WyjJzSrY+5w6d/4usDGRJhs+AB2F/Vmq7peDhZiU=,iv:G+ZbPJ7YiQlrhwt+7EUxWq8pNelw/bUz6thYufh3+rA=,tag:uaCoQ7wg7Rg9xKkq5ZT6NA==,type:str]

k8s/gateway-config-secret.enc.yaml

@@ -18,7 +18,7 @@ sops:
             TVYvcTFHVEMwdk8wb2lZbzBMcWdMOEUKrbjTZ7AeuNqfyWolsYGh0Dc5bE2bDU+y
             vXI+gz8GwN+VNR06G39uE8wAIvlCL9rJocWx9uNcCChZGCaaJu3GPQ==
             -----END AGE ENCRYPTED FILE-----
-          recipient: ***REMOVED***
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^data|^stringData
     lastmodified: "2026-09-13T01:04:23Z"
     mac: ENC[AES256_GCM,data:LN3J+B0QonolFEeisj+NwYjp6F196uIcDyxf4ZoLdAs67Pmpi2YBtB0J4BEbUirR9N13M5k9gWjtDJwgHONYBCjEGC4sCQS3JvNkvwiTf7uSCKaY5+Qq71VtUljf9c9P+Ni/D+zGEVTWHFYtirnsnGpxb/YNYDvbxLFRRI+sLKg=,iv:HQP/SeN+6spVpLRIrYsyBVpbji7YC1oK3lCPmmB0OK0=,tag:e+yfBwzPXSqvBMU4Wn/Tfg==,type:str]