fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen

- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars
- Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE
- Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD)
- Deployment uses envFrom instead of inline env vars
- Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery)
- Update OpenSearch JWKS/issuer URLs to match new slug
- Reloader (auto-reload-all=true) triggers rollout on config change

k8s/app/secret-generator.yaml

@@ -0,0 +1,11 @@
+# KSOPS generator — ArgoCD decrypts auth.enc.yaml at sync time
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: poimen-memory-auth-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - auth.enc.yaml