authentik: repoint server+worker secretKeyRefs to authentik-secrets-infisical

Both AUTHENTIK_SECRET_KEY and AUTHENTIK_POSTGRESQL__PASSWORD (env) -> key
POSTGRES_PASSWORD now sourced from the Infisical-synced secret. Stateless re: DB
(media PVC only), DB-retry logic -> stay RollingUpdate, no Recreate flip.
Applied via kubectl (not ArgoCD-managed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

authentik/deployment-authentik-server.yaml

@@ -44,12 +44,12 @@ spec:
           valueFrom:
             secretKeyRef:
               key: POSTGRES_PASSWORD
-              name: authentik-secrets
+              name: authentik-secrets-infisical
         - name: AUTHENTIK_SECRET_KEY
           valueFrom:
             secretKeyRef:
               key: AUTHENTIK_SECRET_KEY
-              name: authentik-secrets
+              name: authentik-secrets-infisical
         - name: AUTHENTIK_ERROR_REPORTING__ENABLED
           value: 'false'
         image: ghcr.io/goauthentik/server:2024.12.3

authentik/deployment-authentik-worker.yaml

@@ -44,12 +44,12 @@ spec:
           valueFrom:
             secretKeyRef:
               key: POSTGRES_PASSWORD
-              name: authentik-secrets
+              name: authentik-secrets-infisical
         - name: AUTHENTIK_SECRET_KEY
           valueFrom:
             secretKeyRef:
               key: AUTHENTIK_SECRET_KEY
-              name: authentik-secrets
+              name: authentik-secrets-infisical
         - name: AUTHENTIK_ERROR_REPORTING__ENABLED
           value: 'false'
         image: ghcr.io/goauthentik/server:2024.12.3