vaultwarden: repoint envFrom to vaultwarden-secret-infisical + Recreate strategy

Cut the Deployment over to the Infisical-synced Secret and switch to Recreate
(SQLite/WAL on a RWO PVC must not have two writers during a roll). Applied via
kubectl (not ArgoCD-managed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vaultwarden/deployment-vaultwarden.yaml

@@ -15,11 +15,11 @@ spec:
   selector:
     matchLabels:
       app: vaultwarden
+  # Single-replica vaultwarden on a RWO local-path PVC (SQLite + WAL): Recreate
+  # avoids two pods briefly racing the same db.sqlite3 during a roll
+  # (RollingUpdate surges a 2nd pod first).
   strategy:
-    rollingUpdate:
+    type: Recreate
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
   template:
     metadata:
       labels:
@@ -33,7 +33,7 @@ spec:
           value: 'true'
         envFrom:
         - secretRef:
-            name: vaultwarden-secret
+            name: vaultwarden-secret-infisical
         image: vaultwarden/server:1.35.4
         imagePullPolicy: Always
         name: vaultwarden