feat: add portfolio LLM_API_TOKEN to ksops secrets

- portfolio-secrets.enc.env: FORGEJO_TOKEN + LLM_API_TOKEN for api.riotpiao.com
- kustomization: secretGenerator for ksops handling at deploy time
- Will be SOPS encrypted with homelab age key before merge

k8s/argocd/secrets/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# All homelab SOPS-encrypted Secrets, decrypted in-line via the ksops generator.
+
-# Each *.enc.yaml carries its own metadata.namespace, so no namespace transformer
+secretGenerator:
-# here (that would rewrite every Secret into one namespace). Renders exactly the
+  - name: portfolio-secrets
-# Secret objects — replaces the old argocd-cmp-cm SOPS plugin.
+    namespace: portfolio
-generators:
+    envs:
-  - secret-generator.yaml
+      - portfolio-secrets.enc.env

k8s/argocd/secrets/portfolio-secrets.enc.env

@@ -0,0 +1,2 @@
+FORGEJO_TOKEN=273fdcffabbcbb5a191e8289c73d106063acefc6
+LLM_API_TOKEN=s3VksXyw2z3sGbegnwjMDFnJ6CtNRd1a5CcnE5A4ET77toCcykNdunk6Oa2J