fix: extract auth config to ConfigMap + SOPS, update Authentik slug (#40)

## Problem

JWT validation failing with `error decoding response body: expected value at line 6 column 1`.

Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik.

Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them.

## Changes

- **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
- **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS`
- **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption
- **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret
- **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator
- **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug

## Rollout

Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40

Co-authored-by: rock <[email protected]>

k8s/app/config.yaml

@@ -0,0 +1,23 @@
+# Non-sensitive environment variables for poimen-memory
+# Change these without redeploying secrets.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-memory-config
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: poimen-memory
+    app.kubernetes.io/component: config
+data:
+  # Auth mode: jwt | apikey
+  MEM_AUTH_MODE: "jwt"
+  # Rate limiting
+  MEM_RATE_LIMIT_INGEST: "100"
+  MEM_RATE_LIMIT_QUERY: "1000"
+  MEM_IDEMPOTENCY_TTL_SECS: "86400"
+  # Embeddings
+  MEM_EMBEDDING_BATCH_SIZE: "32"
+  # OpenSearch
+  OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
+  # Obsidian
+  OBSIDIAN_URL: "http://obsidian-server.poimen.svc.cluster.local:8080"