k8s: write out the defaulted fields so apply reports InfluxDB unchanged

The NetworkPolicy port gets protocol: TCP, the StatefulSet's volume
claim template apiVersion, kind and volumeMode: Filesystem. Kubernetes
filled these in itself, so every apply -k sent a patch and printed
"configured" although kubectl diff was empty. Validated offline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -138,6 +138,14 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
+  NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
+  the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported
+  both as "configured" while `kubectl diff -k k8s/` was empty (owner). Expected: "unchanged".
+  Validated offline (kustomize + kubeconform); not applied by me. Also found: the in-app update
+  check failed with an IOException because the cluster's `FORGE_TOKEN` was still the template
+  placeholder — the forge refuses it and the server answers 502; `apply -k` does not include
+  the Secrets, so a new token needs `kubectl apply -f k8s/secrets/secrets.yaml` and a restart.
 - 2026-10-25 — App 2.35.3: a car build with the English EVHardware (comments, log lines, the
   "Layer" names); no change in behaviour. Emulator: starts, no crash, the log reads
   "Layer1: …" to "Layer5: …". Not tried on the car.