k8s: work with kubectl apply -f as well as -k

- The secrets template moves to k8s/secrets/, and the filled-in copy to
  k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
  not recurse, so neither the placeholder template nor the real secrets
  can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
  kustomize's images override, which `-f` ignores (it would have pulled
  a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
  creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
  Traefik: TLS is configured on the websecure entrypoint.

Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/ingress.yaml

@@ -1,5 +1,6 @@
-# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. TLS uses
-# Traefik's default certificate, so there is no per-host Certificate here.
+# Routes on the traefik-internal class, like the rest of *.k8s.stinnesbeck.com. No tls section
+# and no per-host Certificate: TLS is configured on Traefik's websecure entrypoint, which serves
+# the default certificate.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -18,7 +19,6 @@ spec:
           name: mg4-server
           namespace: mg4
           port: 80
-  tls: {}
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -39,4 +39,3 @@ spec:
           name: grafana
           namespace: mg4
           port: 80
-  tls: {}