move api secrets from configmap to .env-backed k8s Secret

ctrl/Tiltfile

@@ -16,7 +16,10 @@ if k8s_context() != 'kind-nvi':
 
 local('kubectl --context kind-nvi create namespace nvi --dry-run=client -o yaml | kubectl --context kind-nvi apply -f -')
 
-k8s_yaml(kustomize('k8s/overlays/dev'))
+# --load-restrictor=LoadRestrictionsNone: secretGenerator reads ../../../.env
+# (repo root), which kustomize otherwise refuses for security. Safe here —
+# it's our own repo, the path is explicit, and the only reachable file is .env.
+k8s_yaml(kustomize('k8s/overlays/dev', flags=['--load-restrictor=LoadRestrictionsNone']))
 
 # --- Images ---
 

ctrl/k8s/base/api.yaml

@@ -29,6 +29,8 @@ spec:
           envFrom:
             - configMapRef:
                 name: nvi-config
+            - secretRef:
+                name: nvi-secrets
           readinessProbe:
             httpGet:
               path: /healthz

ctrl/k8s/base/configmap.yaml

@@ -12,14 +12,10 @@ data:
   NVI_DATASET: "financial"
 
   # LLM. Supported providers: groq, anthropic, openai.
+  # Secrets (*_API_KEY) live in the Secret built by kustomize from .env.
   LLM_PROVIDER: "groq"
-  GROQ_API_KEY: "REDACTED_GROQ_API_KEY"
   GROQ_MODEL: "llama-3.3-70b-versatile"
-
-  ANTHROPIC_API_KEY: ""
   ANTHROPIC_MODEL: "claude-sonnet-4-6"
 
   # Langfuse (nivii project in the lng cluster).
   LANGFUSE_HOST: "http://lng.local.ar"
-  LANGFUSE_PUBLIC_KEY: "REDACTED_LANGFUSE_PUBLIC_KEY"
-  LANGFUSE_SECRET_KEY: "REDACTED_LANGFUSE_SECRET_KEY"

ctrl/k8s/base/kustomization.yaml

@@ -21,3 +21,15 @@ configMapGenerator:
       - Caddyfile
     options:
       disableNameSuffixHash: true
+
+# API key Secret built from .env at the repo root. .env is gitignored; only
+# .env.example is committed. The path is relative to this kustomization.yaml
+# (ctrl/k8s/base/) — `../../../.env` resolves to the repo root.
+# disableNameSuffixHash keeps the Secret name stable so api.yaml's secretRef
+# doesn't break on every rebuild.
+secretGenerator:
+  - name: nvi-secrets
+    envs:
+      - ../../../.env
+    options:
+      disableNameSuffixHash: true