security: rotate the published secrets and de-git felhom.secret.yaml (R-925, P1)

WHY .gitignore "was not working": it was working. git never consults
.gitignore for a file it ALREADY TRACKS. The rule `*secret*` matched fine --
proved by dropping an untracked copy in and watching check-ignore name
`.gitignore:3:*secret*`. The file had been tracked since feea0606, which is
ironically the commit that de-gitted the Resend key.

WHAT THE EXPOSED VALUE ACTUALLY WAS. Not an analytics password: the GITEA
ADMIN ACCOUNT PASSWORD (is_admin true; /api/v1/admin/users answered 200), in
a repo gitea.dooplex.hu serves anonymously to the internet. That is push
access to every repo -- including the one whose website/ is git-synced live
and whose scripts/ is published by tag to every new box installer (R-110).
Re-ranked P2 -> P1 on that measurement; my first ranking had only measured
the analytics blast radius.

Every committed value was still live. Nothing had ever been rotated.

ROTATED (values never echoed; written to a 0600 file on DooPlex):
  umami-config        APP_SECRET + POSTGRES_PASSWORD. The password was
                      changed INSIDE postgres (ALTER USER) as well as in the
                      Secret -- the env var is only read at first init, so
                      patching the Secret alone would have changed nothing.
  healthchecks-config SECRET_KEY + SUPERUSER_PASSWORD (nothing consumes them,
                      there is no healthchecks Deployment).
  gitea-creds         no longer holds the admin password at all: a SCOPED
                      token (read:package + read:repository).
  gitea admin         new random password; gitea-system/gitea-admin updated.

VERIFIED, not assumed:
  - new admin password -> 200, OLD PUBLISHED PASSWORD -> 401 (the leak is dead)
  - umami: a real beacon returns 200 (so the app authenticates to postgres and
    writes) while a bogus site id still returns 400 (so the 200 means something)
  - hub: "Registry version check: latest = 0.304.0" AND "Template fetched
    (5881 bytes)", no auth failures
  - BOTH token scopes are load-bearing, and the second was found by breaking
    it: a package-only token made the hub log "Template fetch: unexpected
    status 403", because the template fetcher reads a raw file out of the
    felhom-controller repo, not the registry.

AN INCIDENT CAUSED BY THE FIX, recorded because it is the useful part: the
rollout restart needed to pick up the new umami secret put umami into
CrashLoopBackOff and took stats.felhom.eu down (503) for ~4 minutes. Not the
rotation -- at memory 512Mi that pod runs for months but CANNOT RESTART:
startup (Prisma + Next.js) peaks over the limit and is OOMKilled (exit 137).
Raised to 1Gi IN THE MANIFEST, not just live, per .claude/rules/manifests.md
("never bare kubectl set -- the next sync reverts it and the fix silently
disappears").

THE GATE: KNOWN_BACKLOG is removed from manifest_bearer_gate.py, as its own
comment instructed. Red-proofed with a decoy: exit 1 with it, exit 0 without.
An exemption kept this visible for three months and changed nothing.

WHAT REMAINS (operator, and it is bigger than what was fixed): the same
password is still the admin password in ~12 other namespaces -- nextcloud,
paperless, bookstack (a DATABASE ROOT password), tandoor, calibre,
adventurelog, gokapi, qbittorrent, servarr, homepage. Rotating Gitea does not
touch them. Also owed: a kisfenyo Gitea token sits in plaintext in the local
homelab-manifests remote URL and was printed to a session transcript during
this investigation, so it should be replaced regardless (R-580's shape).

NOT a finding: homelab-manifests is private (404 anonymously) and does not
contain the password; ArgoCD's repo credential is a separate token and was
untouched by the rotation.

STATUS.md

@@ -47,7 +47,28 @@
 - **Still to prove:** the lost off-site copy alarm (Tester 1's next clean-up
   window, about 12 October), and the failed-restore hold (needs a scratch off-site store).
 
-## Needs you soon (2026-10-09): passwords are sitting in a repository anyone on the internet can read
+## Done and still owed (2026-10-09): the published password is dead for Gitea — but it still opens a dozen other things
+
+Following up the finding below, I measured what that password actually was. It was **your Gitea admin login**,
+published on the internet. That is push access to every repository — including the one the website is served from
+and the one new boxes download their installer from. I rotated it, on your instruction.
+
+- **Dead now:** the old password returns "unauthorized" at Gitea. The visitor counter and the health-check tool
+  got fresh random passwords too. The hub no longer holds your admin password at all — it holds a **limited token**
+  that can only read the things it needs.
+- **I broke something briefly and fixed it, and you should know:** restarting the visitor counter to pick up its
+  new password took **stats.felhom.eu down for about four minutes**. Not the password — that service had a memory
+  limit it could run under for months but could never *restart* under. It is raised now, in the file as well as on
+  the server, so the next restart works.
+- **Still open, and this is the bigger half:** the same password is the admin password for about **a dozen other
+  services** — Nextcloud, Paperless, Bookstack (that one is a *database* password), Tandoor, Calibre, qBittorrent
+  and others. Rotating Gitea did nothing for those. Each needs its own new password.
+- **Also:** a Gitea token of yours sits in plain text inside one local repository's settings, and I printed it to
+  my own session while investigating. Worth replacing.
+- **Your passwords are in a protected file on DooPlex** (`rotated-secrets-2026-10-09.txt`). Move them into your
+  password manager and delete it.
+
+## The finding itself (2026-10-09): passwords were sitting in a repository anyone on the internet can read
 
 I found this while publishing the legal pages, not because I went looking — a security check flagged something
 small in the new page, and following it led here.