Deploy server 2.1.0; keep filled-in secrets out of git

- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
  PUBLIC_URL for the pairing QR code; the secrets template gains
  APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
  the template stays on placeholders. This follows a leak where real
  values typed into the template were committed and pushed (amended and
  force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

.gitignore

@@ -39,3 +39,6 @@ mise.local.toml
 /EVHardware/build
 /EVHardware/.gradle
 /EVHardware/**/build
+
+# Filled-in Kubernetes Secrets (copy of k8s/secrets.example.yaml). Never commit.
+/k8s/secrets.yaml