k8s: work with kubectl apply -f as well as -k

- The secrets template moves to k8s/secrets/, and the filled-in copy to
  k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
  not recurse, so neither the placeholder template nor the real secrets
  can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
  kustomize's images override, which `-f` ignores (it would have pulled
  a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
  creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
  Traefik: TLS is configured on the websecure entrypoint.

Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -40,7 +40,7 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go) ──▶ ABRP
 - [x] Manifests validated offline (including Traefik CRDs). **Not applied.**
 - [x] Car app 2.4.0 (pairing by QR): unit tests pass; **not yet tried on the car**.
 - [x] Image `mg4-server:2.1.0` (with pairing) pushed to git.stinnesbeck.com (public; pinned by
-      digest `sha256:e5f6e2d2…` in `k8s/kustomization.yaml`).
+      digest `sha256:e5f6e2d2…` in `k8s/server.yaml`).
 - [ ] Check Grafana's host in `k8s/ingress.yaml` (placeholder `car-grafana.k8s.stinnesbeck.com`).
 - [ ] First pairing and drive with 2.4.0: telemetry arrives in InfluxDB, Grafana and ABRP.
 
@@ -89,7 +89,8 @@ car ──live telemetry───▶ car.k8s.stinnesbeck.com (Go) ──▶ ABRP
   app 2.4.0 shows the QR code and collects its token. Tested end to end against InfluxDB.
 - 2026-10-17 — Incident: a commit swept the filled-in `secrets.example.yaml` (InfluxDB admin token,
   INGEST_TOKEN) into git and pushed it. Commit amended and force-pushed; both values regenerated in
-  the now gitignored `k8s/secrets.yaml`. Filled-in secrets live only there from now on.
+  the now gitignored `k8s/secrets.yaml` (since moved to `k8s/secrets/secrets.yaml`, outside
+  `kubectl apply -f k8s/`). Filled-in secrets live only there from now on.
 - 2026-10-17 — Temporary on-screen diagnostics (b2a5b32) to debug blank values without adb;
   removed again (1002962) once values showed on the car. Revert 1002962 to bring them back.