feat: obsidian git-sync from poimen-obesdient-memory repo

- Add git-sync init container to clone/pull vault content
- Add SOPS-encrypted SSH deploy key (obsidian-git-ssh-secret.enc.yaml)
- Add .sops.yaml config (age encryption, same key as homelab)
- Repo: ssh://[email protected]:2222/rock/poimen-obesdient-memory.git
- Deploy key added to Forgejo repo (read-only)

k8s/app/obsidian.yaml

@@ -21,6 +21,29 @@ spec:
         app.kubernetes.io/part-of: poimen-memory
     spec:
       serviceAccountName: obsidian-server
+      initContainers:
+      - name: git-sync-init
+        image: alpine/git:latest
+        command:
+        - sh
+        - -c
+        - |
+          export GIT_SSH_COMMAND="ssh -i /root/.ssh/id_ed25519 -o StrictHostKeyChecking=no"
+          if [ -d /vault/.git ]; then
+            cd /vault && git pull origin main || true
+          else
+            # Clone into temp, move contents into vault
+            rm -rf /tmp/repo
+            git clone ssh://[email protected]:2222/rock/poimen-obesdient-memory.git /tmp/repo
+            cp -a /tmp/repo/. /vault/
+            rm -rf /tmp/repo
+          fi
+        volumeMounts:
+        - name: vault
+          mountPath: /vault
+        - name: ssh-key
+          mountPath: /root/.ssh
+          readOnly: true
       containers:
       - name: obsidian-server
         image: ppatlabs/obsidian:latest
@@ -72,6 +95,10 @@ spec:
           claimName: obsidian-vault
       - name: config
         emptyDir: {}
+      - name: ssh-key
+        secret:
+          secretName: obsidian-git-ssh
+          defaultMode: 0400
 
 ---
 # PVC for vault storage