n8n: repoint encryption-key secretKeyRef to n8n-secret-infisical + Recreate

Cut n8n over to the Infisical-synced encryption key (byte-identical, key never
changes -> credentials stay decryptable) and switch RollingUpdate -> Recreate
(485MB SQLite + WAL on RWO must not have two writers during a roll).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

n8n/deployment-n8n.yaml

@@ -8,11 +8,12 @@ spec:
   selector:
     matchLabels:
       app: n8n
+  # Single-replica n8n with a 485MB SQLite DB (+ active WAL) on a RWO local-path
+  # PVC: Recreate fully terminates the old pod (releasing the PVC and closing the
+  # SQLite-WAL) before the new pod starts — avoids two writers racing one DB file
+  # (RollingUpdate would surge a 2nd pod first).
   strategy:
-    type: RollingUpdate
+    type: Recreate
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
   template:
     metadata:
       labels:
@@ -31,7 +32,7 @@ spec:
             - name: N8N_ENCRYPTION_KEY
               valueFrom:
                 secretKeyRef:
-                  name: n8n-secret
+                  name: n8n-secret-infisical
                   key: encryption-key
             - name: N8N_HOST
               value: n8n.chemavx.xyz