Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository timeouts; app names the plugin explicitly).