fix(sops-cmp): correct loki s3 path (.loki.storage.s3), emit authentik-secrets separately, drop broken discover — merge via server/worker/migrate envFrom

Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate
authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it
via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository
timeouts; app names the plugin explicitly).

k8s/security/ci-cd/sops-cmp-plugin.yaml

@@ -22,8 +22,6 @@ data:
         command: [sh, -c]
         args:
           - /home/argocd/plugins/generate.sh
-      discover:
-        fileName: "./*.sops-marker"
   generate.sh: |
     #!/bin/sh
     set -eu
@@ -45,8 +43,10 @@ data:
     }
 
     # ── authentik (iam) ────────────────────────────────────────────────
+    # Separate secret (authentik-secrets) merged via envFrom AFTER the chart's
+    # own `authentik` config secret — avoids two ArgoCD apps owning `authentik`.
     DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")"
-    emit_secret iam authentik \
+    emit_secret iam authentik-secrets \
       AUTHENTIK_SECRET_KEY=.authentik.secret_key \
       AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \
       AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \
@@ -55,8 +55,8 @@ data:
     # ── loki S3 (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")"
     emit_secret logging loki-s3-creds \
-      access_key_id=.loki.s3.accessKeyId \
-      secret_access_key=.loki.s3.secretAccessKey
+      access_key_id=.loki.storage.s3.accessKeyId \
+      secret_access_key=.loki.storage.s3.secretAccessKey
 
     # ── grafana (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"