Out-of-band Secret -> Infisical homelab/prod /authentik. Parallel-name target authentik-secrets-infisical (Owner), passthrough of the 2 LIVE keys (AUTHENTIK_SECRET_KEY, POSTGRES_PASSWORD). The dead orphan key AUTHENTIK_POSTGRESQL__PASSWORD is intentionally dropped. Old secret stays live until decommission. Applied via kubectl (not ArgoCD-managed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>