hub + manifests: operator bearer out of git (secretKeyRef report-api)

The global bearer (api.report_api_key) leaves manifests/hub.yaml: the
ConfigMap field is an empty placeholder; the Deployment injects
REPORT_API_KEY from out-of-band Secret/report-api (deliberately NOT
optional - a missing Secret fails Ready rather than booting a hub with an
empty bearer). main.go gains the REPORT_API_KEY env override (the
RESEND_API_KEY twin). scripts/manifest_secret_gate.py blocks bearer-shaped
(64-hex) literals across manifests/ (felhom.secret.yaml's pre-existing
umami APP_SECRET is a visible non-fatal KNOWN-BACKLOG line - secrets.md
backlog, out of scope here).

Ordering (load-bearing): create Secret/report-api with the CURRENT value
BEFORE syncing; this manifest change rides the same sync as the 0.53.0
image (older images ignore the env override). The exposed git-history copy
dies only with the supervised ROTATION - procedure + consumer list in
documentation/runbooks/secrets.md ("Operator/global bearer key"); both
publish runbooks' ROTATION notes now point at that disposition. The
controller repo's example-config copy of the literal is scrubbed
(felhom-controller 51c871a).

Red-proof E: reintroducing a 64-hex literal into manifests/hub.yaml ->
gate exit 1 (recorded); restored clean.

hub/cmd/hub/main.go

@@ -140,6 +140,13 @@ func main() {
 	if v := os.Getenv("RESEND_API_KEY"); v != "" {
 		cfg.Notifications.ResendAPIKey = v
 	}
+	// The operator/global bearer key (api.report_api_key) is sourced from Secret/report-api
+	// (env REPORT_API_KEY) since v0.53.0 — the ConfigMap field is an empty placeholder (the
+	// previously-committed literal is dead once rotated; see the publish-runbook ROTATION
+	// notes). Same pattern as RESEND_API_KEY above.
+	if v := os.Getenv("REPORT_API_KEY"); v != "" {
+		cfg.API.ReportAPIKey = v
+	}
 
 	// Ensure data dir exists
 	os.MkdirAll(cfg.Server.DataDir, 0755)