config: env-based service URIs via ConfigMap (prod: SOPS-encrypted)

- config.yaml: prod config with cluster-internal DNS (LLM, OpenSearch, Authentik, Temporal, API-GW)
- config.local.yaml: dev config with external URLs via ingress
- deployment.yaml: remove hardcoded URIs, read all from ConfigMap envFrom
- All downstream service URIs now configurable per environment
- Production config encrypted with SOPS (Age-based)
- Application code reads LLM_ENDPOINT, OPENSEARCH_HOST, AUTHENTIK_ISSUER, etc. from ENV
- Simplifies prod/dev switching: just swap ConfigMap, no code changes

k8s/app/deployment.yaml

@@ -61,20 +61,12 @@ spec:
             - name: DATABASE_URL
               value: "postgresql://$(DATABASE_USER):$(DATABASE_PASSWORD)@$(DATABASE_HOST):$(DATABASE_PORT)/$(DATABASE_NAME)?sslmode=disable"
 
-            # LLM via api.riotpiao.com (Authentik JWT auth)
-            - name: LLM_ENDPOINT
-              value: "https://api.riotpiao.com/v1/chat/completions"
-            - name: LLM_API_BASE
-              value: "https://api.riotpiao.com/v1"
-            - name: LLM_MODEL
-              value: "ornith:35b"
-
+            # All downstream service URIs read from ConfigMap
+            # (LLM_ENDPOINT, LLM_API_BASE, LLM_MODEL, OPENSEARCH_HOST, etc.)
+            # These are injected via envFrom below
+            
             # Authentik service account (memory-agent-oidc secret)
-            - name: AUTHENTIK_ISSUER
-              valueFrom:
-                secretKeyRef:
-                  name: memory-agent-oidc
-                  key: ISSUER
+            # Only needed if MEM_AUTH_MODE=jwt in ConfigMap
             - name: AUTHENTIK_CLIENT_ID
               valueFrom:
                 secretKeyRef:
@@ -102,6 +94,7 @@ spec:
             - name: MEM_HOME
               value: "/tmp"
           envFrom:
+            # ConfigMap with all service URIs (prod: encrypted, local: plaintext)
             - configMapRef:
                 name: poimen-memory-config
           command: ["/app/mem"]