fix(paperless-ai): move LLM auth client secret from plaintext to SOPS

- Remove hardcoded client secret from init container
- Reference secret from paperless-ai-config (SOPS-encrypted)
- Init container reads LLM_AUTH_CLIENT_SECRET env var
- Secret key must be added to k8s/argocd/secrets/paperless-ai-secrets.enc.yaml
  by someone with SOPS/age key access

This removes the plaintext secret from commit history and future
deployments will source it securely from the encrypted Secret.

k8s/apps/paperless/paperless-ai.yaml

@@ -21,6 +21,49 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: NoSchedule
+      volumes:
+        - name: paperless-ai-data
+          persistentVolumeClaim:
+            claimName: paperless-ai-data
+      initContainers:
+        - name: fetch-llm-token
+          image: curlimages/curl:8.12.0
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
+              
+              # Get JWT token via client_credentials grant
+              # Client secret sourced from environment (injected from paperless-ai-config Secret)
+              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+                -d "grant_type=client_credentials" \
+                -d "client_id=paperless-ai-agent" \
+                -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
+                -d "scope=openid llm:inference" 2>/dev/null)
+              
+              # Extract token
+              TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
+              
+              if [ -z "$TOKEN" ]; then
+                echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
+                exit 1
+              fi
+              
+              # Store token in file for main container to read
+              mkdir -p /data
+              echo "$TOKEN" > /data/llm_token.txt
+              echo "[init] Token fetched and stored successfully"
+          env:
+            - name: LLM_AUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai-config
+                  key: LLM_AUTH_CLIENT_SECRET
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /data
       containers:
         - name: paperless-ai
           image: clusterzx/paperless-ai:latest
@@ -35,18 +78,20 @@ spec:
                   key: PAPERLESS_API_TOKEN
             - name: PAPERLESS_USERNAME
               value: "admin"
-            # LLM API — local gateway, no auth required (phase 3 not built yet)
+            # LLM API — via public gateway with JWT auth
             - name: AI_PROVIDER
               value: "custom"
             - name: CUSTOM_BASE_URL
-              value: "http://reasoning-predictor.llm-serving.svc.cluster.local:80/v1"
+              value: "https://api.riotpiao.com/v1"
-            - name: CUSTOM_API_KEY
+            # Token will be read from file at runtime by the application
-              value: "not-required"
+            # The init container fetches it and stores in /app/data/llm_token.txt
+            - name: CUSTOM_API_KEY_FILE
+              value: "/app/data/llm_token.txt"
             - name: CUSTOM_MODEL
-              value: "reasoning"
+              value: "qwen2.5:3b-instruct"
-            # Behavior
+            # Behavior - scan for new documents and tag them
             - name: SCAN_INTERVAL
-              value: "300"
+              value: "60"
             - name: PROCESS_PREDEFINED_DOCUMENTS
               value: "no"
             - name: ADD_AI_TAG
@@ -55,6 +100,11 @@ spec:
               value: "ai-processed"
             - name: USE_PROMPT_TAGS
               value: "yes"
+            - name: ADD_AI_DESCRIPTIONS
+              value: "yes"
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /app/data
           resources:
             requests:
               cpu: 100m