Deploy server 2.1.0; keep filled-in secrets out of git

- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
  PUBLIC_URL for the pairing QR code; the secrets template gains
  APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
  the template stays on placeholders. This follows a leak where real
  values typed into the template were committed and pushed (amended and
  force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/secrets.example.yaml

@@ -1,5 +1,5 @@
-# TEMPLATE ONLY — not part of kustomization.yaml. Copy it outside the repository, fill in
-# real values, and apply that copy yourself. Never commit the filled-in file.
+# TEMPLATE ONLY — not part of kustomization.yaml. Copy it to k8s/secrets.yaml (gitignored),
+# fill in real values there, and apply that file yourself. Never put real values in here.
 #
 #   openssl rand -hex 32     for every token and password below
 apiVersion: v1
@@ -22,6 +22,9 @@ stringData:
   # The car's write token, entered in the app. At least 24 characters, or the server
   # refuses to start.
   INGEST_TOKEN: CHANGE-ME-openssl-rand-hex-32
+  # Approves a car on your phone when it pairs by QR code (at least 12 characters). Leave it
+  # empty to switch pairing off; then only the INGEST_TOKEN above works.
+  APPROVAL_PASSWORD: CHANGE-ME-at-least-12-characters
   # Your ABRP credentials. Leave either empty to switch forwarding off.
   ABRP_API_KEY: CHANGE-ME
   ABRP_USER_TOKEN: CHANGE-ME