fix(sops-cmp): correct loki s3 path (.loki.storage.s3), emit authentik-secrets separately, drop broken discover — merge via server/worker/migrate envFrom

Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate
authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it
via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository
timeouts; app names the plugin explicitly).

k8s/security/ci-cd/sops-cmp-plugin.yaml

@@ -22,8 +22,6 @@ data:
         command: [sh, -c]
         args:
           - /home/argocd/plugins/generate.sh
-      discover:
-        fileName: "./*.sops-marker"
   generate.sh: |
     #!/bin/sh
     set -eu
@@ -45,8 +43,10 @@ data:
     }
 
     # ── authentik (iam) ────────────────────────────────────────────────
+    # Separate secret (authentik-secrets) merged via envFrom AFTER the chart's
+    # own `authentik` config secret — avoids two ArgoCD apps owning `authentik`.
     DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")"
-    emit_secret iam authentik \
+    emit_secret iam authentik-secrets \
       AUTHENTIK_SECRET_KEY=.authentik.secret_key \
       AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \
       AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \
@@ -55,8 +55,8 @@ data:
     # ── loki S3 (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")"
     emit_secret logging loki-s3-creds \
-      access_key_id=.loki.s3.accessKeyId \
+      access_key_id=.loki.storage.s3.accessKeyId \
-      secret_access_key=.loki.s3.secretAccessKey
+      secret_access_key=.loki.storage.s3.secretAccessKey
 
     # ── grafana (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"

k8s/security/iam/authentik-values.yaml

@@ -92,6 +92,10 @@ _caInitContainers: &caInitContainers
     envFrom:
       - secretRef:
           name: authentik
+      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
+      # merged after the chart config secret — see sops-cmp-plugin.yaml.
+      - secretRef:
+          name: authentik-secrets
     volumeMounts: *caVolumeMounts
 
 _caEnv: &caEnv
@@ -107,6 +111,10 @@ _caEnv: &caEnv
 # Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
 server:
   replicas: 1
+  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   service:
@@ -145,6 +153,9 @@ server:
 # into the server process but the worker pod is still required.
 worker:
   replicas: 1
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   resources: