secrets: rotate + de-git Resend key; source from out-of-band Secret/resend-api

Resend send-scoped key was committed in plaintext in manifests/hub.yaml (ConfigMap)
and manifests/felhom.secret.yaml. Rotated to a new key and removed from git.

- hub: new RESEND_API_KEY env override (cmd/hub/main.go), mirrors REGISTRY_TOKEN;
  ConfigMap resend_api_key now an empty placeholder; Deployment injects from
  Secret/resend-api. Image 0.17.0.
- contact-mailer: secretKeyRef repointed contact-mailer-config -> resend-api.
- felhom.secret.yaml: contact-mailer-config Secret removed; healthchecks
  EMAIL_HOST_PASSWORD blanked (workload not deployed).
- documentation/runbooks/secrets.md: out-of-band secret model + create/rotate steps.

Secret/resend-api is created imperatively out-of-band and is NOT committed.
No secret value appears in this repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/cmd/hub/main.go

@@ -93,6 +93,12 @@ func main() {
 	if v := os.Getenv("DEFAULT_MIN_CONTROLLER_VERSION"); v != "" {
 		cfg.ControllerUpdates.DefaultMinVersion = v
 	}
+	// Resend API key is sourced from Secret/resend-api (env RESEND_API_KEY), never from the
+	// committed ConfigMap — see documentation/runbooks/secrets.md. The ConfigMap field stays
+	// empty as a placeholder; this override is the live source.
+	if v := os.Getenv("RESEND_API_KEY"); v != "" {
+		cfg.Notifications.ResendAPIKey = v
+	}
 
 	// Ensure data dir exists
 	os.MkdirAll(cfg.Server.DataDir, 0755)