k8s: work with kubectl apply -f as well as -k

- The secrets template moves to k8s/secrets/, and the filled-in copy to
  k8s/secrets/secrets.yaml (gitignored). `kubectl apply -f k8s/` does
  not recurse, so neither the placeholder template nor the real secrets
  can be applied by accident.
- The server image digest is pinned in server.yaml instead of through
  kustomize's images override, which `-f` ignores (it would have pulled
  a nonexistent :latest).
- README and kustomization.yaml say to use `-k`: plain `-f` never
  creates the generated Grafana ConfigMaps.
- The IngressRoutes drop `tls: {}`, like the other routes on this
  Traefik: TLS is configured on the websecure entrypoint.

Manifests validated both ways (14 resources rendered with kustomize,
11 as plain files — the difference is the Grafana ConfigMaps).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/kustomization.yaml

@@ -1,5 +1,5 @@
-# Render with `kustomize build k8s/` (or `kubectl kustomize k8s/`) and apply it yourself.
-# The Secrets are not included: create them from secrets.example.yaml first.
+# Apply with `kubectl apply -k k8s/` — not `-f k8s/`, which skips the Grafana ConfigMaps below.
+# The Secrets are not included: create them from secrets/secrets.example.yaml first.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
@@ -8,10 +8,6 @@ resources:
   - server.yaml
   - grafana.yaml
   - ingress.yaml
-images:
-  - name: git.stinnesbeck.com/nils/mg4-server
-    # 2.1.0, pinned by digest so a re-pushed tag cannot change what runs.
-    digest: sha256:e5f6e2d2ef9dc2650055a0823a3f86d8903e46918a76e990540482edf819766d
 generatorOptions:
   labels:
     app.kubernetes.io/part-of: mg4