fix(sops-cmp): correct loki s3 path (.loki.storage.s3), emit authentik-secrets separately, drop broken discover — merge via server/worker/migrate envFrom

Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate
authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it
via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository
timeouts; app names the plugin explicitly).

k8s/security/iam/authentik-values.yaml

@@ -92,6 +92,10 @@ _caInitContainers: &caInitContainers
     envFrom:
       - secretRef:
           name: authentik
+      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
+      # merged after the chart config secret — see sops-cmp-plugin.yaml.
+      - secretRef:
+          name: authentik-secrets
     volumeMounts: *caVolumeMounts
 
 _caEnv: &caEnv
@@ -107,6 +111,10 @@ _caEnv: &caEnv
 # Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
 server:
   replicas: 1
+  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   service:
@@ -145,6 +153,9 @@ server:
 # into the server process but the worker pod is still required.
 worker:
   replicas: 1
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   resources: