fix: add CreateOnly sync option to n8n-secret to prevent ArgoCD from overwriting encryption key

n8n/secret-n8n-secret.yaml

@@ -4,9 +4,10 @@ metadata:
   name: n8n-secret
   namespace: n8n
   annotations:
-    argocd.argoproj.io/sync-options: "Prune=false"
-    # data managed manually — do NOT store the real value here
-    # create/update with: kubectl create secret generic n8n-secret \
+    # CreateOnly: ArgoCD creates this secret if it doesn't exist but never overwrites it.
+    # Populate the key manually before first deploy:
+    #   kubectl create secret generic n8n-secret \
     #     --from-literal=encryption-key='<value-from-vaultwarden>' \
     #     -n n8n --dry-run=client -o yaml | kubectl apply -f -
+    argocd.argoproj.io/sync-options: "CreateOnly=true"
 type: Opaque