zona-exclusion: repoint SMTP to Infisical secret + Recreate strategy (3b)

- mail__options__auth__user/pass secretKeyRef
    zona-exclusion-secrets -> zona-exclusion-secrets-infisical (remapped keys)
- strategy RollingUpdate -> Recreate (single-replica RWO SQLite Ghost; avoids
    two-pods-on-one-ghost.db overlap during rolls)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

zona-exclusion/deployment.yaml

@@ -30,6 +30,10 @@ metadata:
     app: zona-exclusion
 spec:
   replicas: 1
+  # Single-replica Ghost on a RWO local-path SQLite DB: Recreate avoids two Ghost
+  # processes briefly sharing one ghost.db during a roll (RollingUpdate corruption risk).
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: zona-exclusion
@@ -56,12 +60,12 @@ spec:
             - name: mail__options__auth__user
               valueFrom:
                 secretKeyRef:
-                  name: zona-exclusion-secrets
+                  name: zona-exclusion-secrets-infisical
                   key: smtp-user
             - name: mail__options__auth__pass
               valueFrom:
                 secretKeyRef:
-                  name: zona-exclusion-secrets
+                  name: zona-exclusion-secrets-infisical
                   key: smtp-pass
             - name: mail__from
               value: "Zona de Exclusión <chemavx@gmail.com>"