docs(sekrety): dołożenie klucza do ISTNIEJĄCEGO sekretu, nie tylko tworzenie

Po zmergowaniu LOG-34 pody prezentacji nie wstały:
  Error: couldn't find key SESSION_SECRET in Secret astrololo/astrololo-auth

Runbook opisywał wyłącznie ścieżkę instalacji OD ZERA — SESSION_SECRET pojawiał
się tylko w komendzie `create secret`. Na działającym wdrożeniu sekret już
istnieje, a merge manifestu kluczy do niego nie dokłada; każe ich tylko szukać.

Gorzej: opisana rotacja też by tam nie zadziałała. Używała JSON Patch z
`op: replace` na /data/SESSION_SECRET, a `replace` wymaga, żeby ścieżka już
istniała — czyli jedyna komenda, po którą sięgnąłby ktoś w tej sytuacji, też
odmawia.

Teraz obie potrzeby obsługuje JEDNA komenda: `--type=merge` ze `stringData`
dokłada albo nadpisuje i nie wymaga wcześniejszego istnienia klucza. Dopisane
sprawdzenie kompletu kluczy bez pokazywania wartości oraz to samo ostrzeżenie
w runbooku demo, gdzie czeka dokładnie ta sama pułapka.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

astrololo/kustomization.yaml

@@ -11,10 +11,10 @@ resources:
   - ingress.yaml # wejście po https + przekierowanie z http
 images:
   - name: gitea.czernobog.pl/gitea/astrololo-data
-    newTag: 10ade555
+    newTag: f0d07ee8
   - name: gitea.czernobog.pl/gitea/astrololo-logic
-    newTag: 10ade555
+    newTag: f0d07ee8
   - name: gitea.czernobog.pl/gitea/astrololo-render
     newTag: latest
   - name: gitea.czernobog.pl/gitea/astrololo-presentation
-    newTag: 10ade555
+    newTag: f0d07ee8

conjurer/bot.yaml

@@ -31,19 +31,6 @@ spec:
             # Where the librarian sends THIS bot's results/pongs back to (its own
             # NodePort). Lets one librarian serve both bots - see deploy-bot.yaml.
             - { name: CONJURER_SELF_CALLBACK,     value: "http://192.168.1.73:32442" }
-            # Self-hosted models (Ollama). No API key - the endpoint IS the
-            # configuration, and the backend stays unselectable while unset.
-            # Pick a model at runtime with: $gadaj_teraz ollama <model>
-            # ($modele_ai lists what the server actually has pulled).
-            - { name: CONJURER_OLLAMA_URL,        value: "http://192.168.1.72:11434" }
-            # The server currently has exactly one model pulled (verified via
-            # /v1/models): gemma4:e2b. Without this the built-in default
-            # (llama3.1:8b) would be requested and every reply would fail.
-            - { name: CONJURER_OLLAMA_MODEL,      value: "gemma4:e2b" }
-            # Self-hosted generation is far slower than a hosted API, especially
-            # the first request after the model is evicted from VRAM. Applies to
-            # every backend, so keep it only as high as you actually need.
-            - { name: CONJURER_AI_TIMEOUT_SECONDS, value: "240" }
           volumeMounts:
             - { name: data,  mountPath: /data }
             - { name: netrc, mountPath: /secrets, readOnly: true }

conjurer/deploy-bot.yaml

@@ -51,19 +51,6 @@ spec:
             # query and answers results/pongs HERE - so it serves this bot AND the
             # test bot from one instance, no CONJURER_MAIN_BOT repointing needed.
             - { name: CONJURER_SELF_CALLBACK,     value: "http://192.168.1.73:32443" }
-            # Self-hosted models (Ollama). No API key - the endpoint IS the
-            # configuration, and the backend stays unselectable while unset.
-            # Pick a model at runtime with: $gadaj_teraz ollama <model>
-            # ($modele_ai lists what the server actually has pulled).
-            - { name: CONJURER_OLLAMA_URL,        value: "http://192.168.1.72:11434" }
-            # The server currently has exactly one model pulled (verified via
-            # /v1/models): gemma4:e2b. Without this the built-in default
-            # (llama3.1:8b) would be requested and every reply would fail.
-            - { name: CONJURER_OLLAMA_MODEL,      value: "gemma4:e2b" }
-            # Self-hosted generation is far slower than a hosted API, especially
-            # the first request after the model is evicted from VRAM. Applies to
-            # every backend, so keep it only as high as you actually need.
-            - { name: CONJURER_AI_TIMEOUT_SECONDS, value: "240" }
           volumeMounts:
             - { name: data,  mountPath: /data }
             - { name: netrc, mountPath: /secrets, readOnly: true }

conjurer/kustomization.yaml

@@ -8,9 +8,9 @@ resources:
   - deploy-bot-backup.yaml
 images:
   - name: gitea.czernobog.pl/gitea/conjurer-librarian
-    newTag: fdc1fa18
+    newTag: d0c7ab61
   - name: gitea.czernobog.pl/gitea/conjurer-bot
-    newTag: fdc1fa18
+    newTag: d0c7ab61
   # Production bot channel - only bumped when a [deploy]-tagged build appears.
   # Bootstrapped to fbd1ec9f: that's the image the first [deploy] build (merge
   # of conjurer#20) promoted to conjurer-bot-deploy. From here the image-updater