hub + manifests: operator bearer out of git (secretKeyRef report-api)

The global bearer (api.report_api_key) leaves manifests/hub.yaml: the
ConfigMap field is an empty placeholder; the Deployment injects
REPORT_API_KEY from out-of-band Secret/report-api (deliberately NOT
optional - a missing Secret fails Ready rather than booting a hub with an
empty bearer). main.go gains the REPORT_API_KEY env override (the
RESEND_API_KEY twin). scripts/manifest_secret_gate.py blocks bearer-shaped
(64-hex) literals across manifests/ (felhom.secret.yaml's pre-existing
umami APP_SECRET is a visible non-fatal KNOWN-BACKLOG line - secrets.md
backlog, out of scope here).

Ordering (load-bearing): create Secret/report-api with the CURRENT value
BEFORE syncing; this manifest change rides the same sync as the 0.53.0
image (older images ignore the env override). The exposed git-history copy
dies only with the supervised ROTATION - procedure + consumer list in
documentation/runbooks/secrets.md ("Operator/global bearer key"); both
publish runbooks' ROTATION notes now point at that disposition. The
controller repo's example-config copy of the literal is scrubbed
(felhom-controller 51c871a).

Red-proof E: reintroducing a 64-hex literal into manifests/hub.yaml ->
gate exit 1 (recorded); restored clean.

manifests/hub.yaml

@@ -15,14 +15,12 @@
 #        htpasswd -nbBC 10 "" "your-password" | cut -d: -f2
 #      Update the ConfigMap password_hash field below.
 #
-#   3. Generate a report API key (shared secret for controllers):
-#        openssl rand -hex 32
-#      Update the ConfigMap report_api_key field below.
-#      Then add the same key to each customer's controller.yaml:
-#        hub:
-#          enabled: true
-#          url: "https://hub.felhom.eu"
-#          api_key: "<same-key>"
+#   3. Create the operator/global bearer key Secret (out-of-band, NEVER committed):
+#        openssl rand -hex 32   # mint
+#        kubectl -n felhom-system create secret generic report-api \
+#          --from-literal=REPORT_API_KEY=<minted-key>
+#      (Customer boxes use per-customer/per-host keys generated by the hub — the global
+#       key is the operator's own, e.g. felhom-ops -hub-key.)
 #
 #   4. Apply this manifest:
 #        kubectl apply -f manifests/hub.yaml
@@ -71,10 +69,11 @@ data:
       # Generate: htpasswd -nbBC 10 "" "your-password" | cut -d: -f2
       password_hash: "$2y$10$N5.O9jBnc.1tIlJT/irx3OlVjJQemlCHRnfqIJg/EyZofnzXSCpeG"
     api:
-      # Shared secret for controller → hub report push
-      # Generate: openssl rand -hex 32
-      # Must match hub.api_key in each customer's controller.yaml
-      report_api_key: "094091de545ce28795c47ac2158fc30750db5c24a621c49329b001ee8db57fb8"
+      # Operator/global bearer key. NOT stored here since v0.53.0 — injected at runtime from
+      # Secret/report-api via the REPORT_API_KEY env var (see Deployment below). The Secret is
+      # created out-of-band and NOT committed (documentation/runbooks/secrets.md); the previously
+      # committed literal is retired by ROTATION (see the publish-runbook notes). Leave empty.
+      report_api_key: ""
     retention:
       max_days: 90
       prune_schedule: "04:30"
@@ -144,6 +143,15 @@ spec:
                 secretKeyRef:
                   name: resend-api
                   key: RESEND_API_KEY
+            # Operator/global bearer key — injected from the out-of-band Secret/report-api
+            # (NOT committed; documentation/runbooks/secrets.md). Deliberately NOT optional:
+            # a missing Secret must fail the pod Ready rather than boot an unauthenticatable
+            # hub with an empty bearer key. Create the Secret BEFORE syncing this manifest.
+            - name: REPORT_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: report-api
+                  key: REPORT_API_KEY
             - name: REGISTRY_USERNAME
               valueFrom:
                 secretKeyRef: