SOPS-Decrypted Secrets

Placeholder for CMP-generated secrets (pending full CMP plugin setup).

Currently, manually-created Secrets live in individual namespaces (e.g., grafana-admin in logging/). Once the CMP plugin is wired, this Application will decode *.enc.yaml and emit all Secrets here.