secrets: rotate + de-git Resend key; source from out-of-band Secret/resend-api

Resend send-scoped key was committed in plaintext in manifests/hub.yaml (ConfigMap)
and manifests/felhom.secret.yaml. Rotated to a new key and removed from git.

- hub: new RESEND_API_KEY env override (cmd/hub/main.go), mirrors REGISTRY_TOKEN;
  ConfigMap resend_api_key now an empty placeholder; Deployment injects from
  Secret/resend-api. Image 0.17.0.
- contact-mailer: secretKeyRef repointed contact-mailer-config -> resend-api.
- felhom.secret.yaml: contact-mailer-config Secret removed; healthchecks
  EMAIL_HOST_PASSWORD blanked (workload not deployed).
- documentation/runbooks/secrets.md: out-of-band secret model + create/rotate steps.

Secret/resend-api is created imperatively out-of-band and is NOT committed.
No secret value appears in this repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

manifests/contact-mailer.yaml

@@ -10,10 +10,10 @@
 #      # Option B: Import directly into k3s (single node):
 #      #   docker save contact-mailer:latest | sudo k3s ctr images import -
 #
-#   2. Create the Secret with your Resend API key:
-#      kubectl create secret generic contact-mailer-config \
-#        --namespace=felhom-system \
-#        --from-literal=RESEND_API_KEY='re_xxxxxxxxxxxx'
+#   2. The Resend API key comes from the out-of-band Secret/resend-api (NOT committed).
+#      Create it per documentation/runbooks/secrets.md (key sourced from the out-of-band store):
+#        kubectl create secret generic resend-api -n felhom-system \
+#          --from-literal=RESEND_API_KEY="$RESEND_API"
 #
 #   3. Apply this manifest:
 #      kubectl apply -f contact-mailer.yaml
@@ -56,10 +56,12 @@ spec:
           ports:
             - containerPort: 8080
           env:
+            # Resend API key — injected from the shared out-of-band Secret/resend-api (NOT committed).
+            # See documentation/runbooks/secrets.md.
             - name: RESEND_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: contact-mailer-config
+                  name: resend-api
                   key: RESEND_API_KEY
             - name: FROM_EMAIL
               value: "Felhom.eu <noreply@felhom.eu>"

manifests/felhom.secret.yaml

@@ -17,19 +17,17 @@ stringData:
   EMAIL_HOST: "smtp.resend.com"
   EMAIL_PORT: "587"
   EMAIL_HOST_USER: "resend"
-  EMAIL_HOST_PASSWORD: "re_XZZenCJs_LyJnU12jZWfEn9rK85Gc83DK"
+  # Resend API key — NOT committed. Healthchecks is not currently deployed; when it is, wire its
+  # EMAIL_HOST_PASSWORD to the out-of-band Secret/resend-api (key RESEND_API_KEY) via secretKeyRef
+  # instead of inlining a value here. See documentation/runbooks/secrets.md.
+  EMAIL_HOST_PASSWORD: ""
   EMAIL_USE_TLS: "True"
   EMAIL_USE_VERIFICATION: "False"
   DEFAULT_FROM_EMAIL: "monitoring@felhom.eu"
 ---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: contact-mailer-config
-  namespace: felhom-system
-type: Opaque
-stringData:
-  RESEND_API_KEY: 're_XZZenCJs_LyJnU12jZWfEn9rK85Gc83DK'
+# NOTE: the Resend API key (formerly Secret/contact-mailer-config RESEND_API_KEY) is no longer
+# committed. It lives in the out-of-band Secret/resend-api (key RESEND_API_KEY), created imperatively
+# per documentation/runbooks/secrets.md. Both the hub and contact-mailer now read from resend-api.
 ---
 apiVersion: v1
 kind: Secret

manifests/hub.yaml

@@ -81,7 +81,10 @@ data:
     alerting:
       stale_threshold: "30m"
     notifications:
-      resend_api_key: "re_XZZenCJs_LyJnU12jZWfEn9rK85Gc83DK"
+      # Resend API key is NOT stored here. It is injected at runtime from Secret/resend-api
+      # via the RESEND_API_KEY env var (see Deployment below). The Secret is created out-of-band
+      # and is NOT committed — see documentation/runbooks/secrets.md. Leave this empty.
+      resend_api_key: ""
     registry:
       image: "gitea.dooplex.hu/admin/felhom-controller"
       # username + token injected via REGISTRY_USERNAME / REGISTRY_TOKEN env vars
@@ -117,7 +120,7 @@ spec:
     spec:
       containers:
         - name: hub
-          image: gitea.dooplex.hu/admin/felhom-hub:0.16.0
+          image: gitea.dooplex.hu/admin/felhom-hub:0.17.0
           ports:
             - containerPort: 8080
               name: http
@@ -128,6 +131,13 @@ spec:
             # this auto-updates to it (unless a per-customer override is set via the operator UI).
             - name: DEFAULT_MIN_CONTROLLER_VERSION
               value: "0.87.0"
+            # Resend API key — injected from the out-of-band Secret/resend-api (NOT committed).
+            # See documentation/runbooks/secrets.md. Overrides the empty ConfigMap placeholder.
+            - name: RESEND_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: resend-api
+                  key: RESEND_API_KEY
             - name: REGISTRY_USERNAME
               valueFrom:
                 secretKeyRef: