move api secrets from configmap to .env-backed k8s Secret

ctrl/k8s/base/kustomization.yaml

@@ -21,3 +21,15 @@ configMapGenerator:
       - Caddyfile
     options:
       disableNameSuffixHash: true
+
+# API key Secret built from .env at the repo root. .env is gitignored; only
+# .env.example is committed. The path is relative to this kustomization.yaml
+# (ctrl/k8s/base/) — `../../../.env` resolves to the repo root.
+# disableNameSuffixHash keeps the Secret name stable so api.yaml's secretRef
+# doesn't break on every rebuild.
+secretGenerator:
+  - name: nvi-secrets
+    envs:
+      - ../../../.env
+    options:
+      disableNameSuffixHash: true