Deploy server 2.1.0; keep filled-in secrets out of git

- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
  PUBLIC_URL for the pairing QR code; the secrets template gains
  APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
  the template stays on placeholders. This follows a leak where real
  values typed into the template were committed and pushed (amended and
  force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/kustomization.yaml

@@ -10,8 +10,8 @@ resources:
   - ingress.yaml
 images:
   - name: git.stinnesbeck.com/nils/mg4-server
-    # 2.0.0, pinned by digest so a re-pushed tag cannot change what runs.
-    digest: sha256:6feea777c514b9488ffb0b49fad7c15423ee06f0e0e8d609cf31eb85755da815
+    # 2.1.0, pinned by digest so a re-pushed tag cannot change what runs.
+    digest: sha256:e5f6e2d2ef9dc2650055a0823a3f86d8903e46918a76e990540482edf819766d
 generatorOptions:
   labels:
     app.kubernetes.io/part-of: mg4