Deploy server 2.1.0; keep filled-in secrets out of git

- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
  PUBLIC_URL for the pairing QR code; the secrets template gains
  APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
  the template stays on placeholders. This follows a leak where real
  values typed into the template were committed and pushed (amended and
  force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -25,7 +25,9 @@ car ──live telemetry───▶ car.stinnesbeck.com (Go) ──▶ ABRP  ap
 - **Dashboards:** Grafana, provisioned from `k8s/grafana/`: Live (stats, SoC/range, power/speed,
   route map, temperatures, tyres), Consumption (period totals, lifetime, SoH, per-day energy,
   distance and efficiency) and Charging (totals, session table, curves). Prices in euro.
-- **Car app:** Server tab (URL, ingest token, installation id, config import); live telemetry
+- **Pairing:** the car shows a QR code, a phone approves it with the approval password, and the car
+  gets its own token (RFC 8628-style; `server/README.md`). The shared `INGEST_TOKEN` still works.
+- **Car app:** Server tab (URL, pairing by QR, ingest token, installation id, config import); live telemetry
   every 15 s while driving or charging; consumption chunks and charging sessions as before.
 - **Deployment:** `k8s/`, plain manifests. **Nothing is ever applied to the cluster by us** —
   Nils applies them (`k8s/README.md`). TLS comes from Traefik's default certificate.
@@ -36,12 +38,12 @@ car ──live telemetry───▶ car.stinnesbeck.com (Go) ──▶ ABRP  ap
 - [x] End-to-end in podman (server + InfluxDB 2.7.12 + Grafana 13.2.3): every endpoint, retry
       idempotency, all 25 dashboard queries return data, dashboards rendered and checked.
 - [x] Manifests validated offline (including Traefik CRDs). **Not applied.**
-- [x] Car app 2.3.0: unit tests and lint pass; **not yet tried on the car**.
-- [x] Image `mg4-server:2.0.0` pushed to git.stinnesbeck.com (public; pinned by digest
-      `sha256:6feea777…` in `k8s/kustomization.yaml`).
+- [x] Car app 2.4.0 (pairing by QR): unit tests pass; **not yet tried on the car**.
+- [x] Image `mg4-server:2.1.0` (with pairing) pushed to git.stinnesbeck.com (public; pinned by
+      digest `sha256:e5f6e2d2…` in `k8s/kustomization.yaml`).
 - [ ] Check in `k8s/ingress.yaml`: the Traefik ingress class (placeholder `traefik-external`) and
       Grafana's host (placeholder `car-grafana.stinnesbeck.com`).
-- [ ] First drive with 2.3.0: telemetry arrives in InfluxDB, Grafana and ABRP.
+- [ ] First pairing and drive with 2.4.0: telemetry arrives in InfluxDB, Grafana and ABRP.
 
 ## To do
 
@@ -84,6 +86,11 @@ car ──live telemetry───▶ car.stinnesbeck.com (Go) ──▶ ABRP  ap
 - 2026-10-17 — Server rewritten in Go (API only); dashboards moved to Grafana with provisioned
   InfluxDB datasource and three dashboards; the Next.js app (`web/`) removed. Per-host
   cert-manager certificates dropped in favour of Traefik's default certificate.
+- 2026-10-17 — Pairing by QR code: server 2.1.0 issues per-car tokens after approval on a phone;
+  app 2.4.0 shows the QR code and collects its token. Tested end to end against InfluxDB.
+- 2026-10-17 — Incident: a commit swept the filled-in `secrets.example.yaml` (InfluxDB admin token,
+  INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in
+  the now gitignored `k8s/secrets.yaml`. Filled-in secrets live only there from now on.
 - 2026-10-17 — Temporary on-screen diagnostics (b2a5b32) to debug blank values without adb;
   removed again (1002962) once values showed on the car. Revert 1002962 to bring them back.