Deploy server 2.1.0; keep filled-in secrets out of git

- kustomization pins mg4-server 2.1.0 by digest; server.yaml sets
  PUBLIC_URL for the pairing QR code; the secrets template gains
  APPROVAL_PASSWORD.
- Filled-in Secrets now go into k8s/secrets.yaml, which is gitignored;
  the template stays on placeholders. This follows a leak where real
  values typed into the template were committed and pushed (amended and
  force-pushed since; both values regenerated).
- SPECS.md records pairing and the incident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/server.yaml

@@ -40,12 +40,16 @@ spec:
               value: mg4
             - name: INFLUX_BUCKET
               value: mg4
+            # Where a phone reaches the server; the pairing QR code points here.
+            - name: PUBLIC_URL
+              value: https://car.stinnesbeck.com
             - name: INFLUX_TOKEN
               valueFrom:
                 secretKeyRef:
                   name: influxdb-auth
                   key: admin-token
-          # INGEST_TOKEN, ABRP_API_KEY, ABRP_USER_TOKEN, ABRP_MIN_INTERVAL_SECONDS.
+          # INGEST_TOKEN, APPROVAL_PASSWORD, ABRP_API_KEY, ABRP_USER_TOKEN,
+          # ABRP_MIN_INTERVAL_SECONDS.
           envFrom:
             - secretRef:
                 name: mg4-server