fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen

- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars
- Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE
- Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD)
- Deployment uses envFrom instead of inline env vars
- Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery)
- Update OpenSearch JWKS/issuer URLs to match new slug
- Reloader (auto-reload-all=true) triggers rollout on config change

k8s/app/config.yaml

@@ -0,0 +1,23 @@
+# Non-sensitive environment variables for poimen-memory
+# Change these without redeploying secrets.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: poimen-memory-config
+  namespace: poimen
+  labels:
+    app.kubernetes.io/name: poimen-memory
+    app.kubernetes.io/component: config
+data:
+  # Auth mode: jwt | apikey
+  MEM_AUTH_MODE: "jwt"
+  # Rate limiting
+  MEM_RATE_LIMIT_INGEST: "100"
+  MEM_RATE_LIMIT_QUERY: "1000"
+  MEM_IDEMPOTENCY_TTL_SECS: "86400"
+  # Embeddings
+  MEM_EMBEDDING_BATCH_SIZE: "32"
+  # OpenSearch
+  OPENSEARCH_HOST: "opensearch.poimen.svc.cluster.local:9200"
+  # Obsidian
+  OBSIDIAN_URL: "http://obsidian-server.poimen.svc.cluster.local:8080"