fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian

- discovery.type: single-node (bypasses vm.max_map_count bootstrap check)
- fsGroup: 1000 (fixes AccessDeniedException on PVC data dir)
- control-plane tolerations (schedulable on CP nodes)
- secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
- remove orphaned obsidian-git-ssh-secret.enc.yaml

k8s/infra/databases/opensearch.yaml

@@ -65,8 +65,7 @@ data:
     # Cluster settings
     cluster.name: poimen-memory
     node.name: ${HOSTNAME}
-    cluster.initial_master_nodes: opensearch-0
-    discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local
+    discovery.type: single-node
     
     # Network
     network.host: 0.0.0.0
@@ -127,16 +126,12 @@ spec:
     spec:
       serviceAccountName: opensearch
       hostNetwork: false
-      
-      initContainers:
-        - name: sysctl
-          image: busybox:1.28
-          command:
-            - sysctl
-            - -w
-            - vm.max_map_count=262144
-          securityContext:
-            privileged: true
+      securityContext:
+        fsGroup: 1000
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
       
       containers:
         - name: opensearch
@@ -400,18 +395,6 @@ spec:
 
 ---
 
-# Secret: OpenSearch Dashboards password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-dashboards-secret
-  namespace: poimen
-type: Opaque
-stringData:
-  password: "admin"  # ⚠️  Change in production
-
----
-
 # ServiceAccount for OpenSearch Dashboards
 apiVersion: v1
 kind: ServiceAccount
@@ -419,14 +402,4 @@ metadata:
   name: opensearch-dashboards
   namespace: poimen
 
----
-
-# Secret for OpenSearch Admin Password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-secrets
-  namespace: poimen
-type: Opaque
-stringData:
-  admin-password: "OpenSearch@Admin123!"
+# Secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)