feat(infra): update SOPS configuration, cloud-init templates, and secondary disk automation (#26)

### Summary of Changes

This PR incorporates the final infrastructure optimizations following
the initial merge of PR #25:

1. **SOPS & Secrets Management**:
- Generated dedicated Age keypair
(`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and
updated `.sops.yaml`.
- Added SOPS-encrypted production secrets for PostgreSQL
(`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics
(`ci/k8s/apps/umami/secret.sops.yaml`).
   - Verified 100% clean round-trip decryption.

2. **Cloud-Init Template & Git Safety**:
- Converted `user-data.yaml` into `user-data.template.yaml` with clear
stubs for public SSH keys and private Age keys.
- Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent
accidental secret leaks.

3. **Persistent Secondary Storage**:
- Added automated detection, ext4 formatting, and mounting of secondary
persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with
`noatime` in `user-data.template.yaml`.

4. **Golden Image Naming & Workflows**:
- Updated image naming convention to include hyphenated UTC timestamps:
`com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`.
   - Verified successful CI golden image build and S3 upload.

ci/k8s/apps/postgres/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 namespace: com-ermnvldmr
 resources:
   - configmap.yaml
-  - secret.template.yaml
+  - secret.sops.yaml
   - pvc.yaml
   - statefulset.yaml
   - service.yaml

ci/k8s/apps/postgres/secret.sops.yaml

@@ -0,0 +1,25 @@
+apiVersion: ENC[AES256_GCM,data:XU0=,iv:0HP8xIgbhQzBxIAsUBnkxi7wWMuyedsyOMC+zO9Fvw8=,tag:H7rYCSkBAog0ut4eXP9dWQ==,type:str]
+kind: ENC[AES256_GCM,data:8nu6otux,iv:FiHwWJpQDxF/LS5lfqYsH3Fk3YCEp+OZstpmvgGI5s4=,tag:tsiQtQH/W3SQ1Dk7ov65NA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:2PmmHyt4B6+tnYUb7R+zbA==,iv:Ox++aI1pcNWSnaYZRsto9hh1X9rrX9nb/Ra+MeDbAKI=,tag:kYfWd1QRRyEgb6RZ24OYGA==,type:str]
+    namespace: ENC[AES256_GCM,data:85gh76P2r88Y7KHsoQ==,iv:GPDJiMPubS/0VsIBlCKpYMrX2XWa+U/3pG3pHBIXFnI=,tag:HLMCW7lh9pQV3elfkSsBBA==,type:str]
+type: ENC[AES256_GCM,data:7QaM8COE,iv:2oml3iRBnXZvlGqAJEXBg3BR/hq7gw0f7+UoMFsxOtI=,tag:e7Ky0fjons6BQdsF/ynknw==,type:str]
+stringData:
+    POSTGRES_DB: ENC[AES256_GCM,data:+7B7L0Y=,iv:iIqQkEL4DWIcb4HkfURJeMe9NUVLCHumc1GcHwIzwLQ=,tag:xWLqm+WBWvm8F0MH71WtMA==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:L+H5q14=,iv:3M0Vp0+HYOeQAUxPcjZEnY2KUTr26ehVjEMjdF5nYWE=,tag:z8KhOSWQnsLxpkernIrx+w==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:dwrnI8QNbyWuTIIW1CsUvlLu9xQR6qXYygBVtbc213VAVX3A6nh8lA==,iv:qN2ApXdPHviuAamJ/4vf6FCA0BiIQO4QKeI+HPg/Msg=,tag:kNfLE4lgCT0T6CUx8EW6Dg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdnhpb2RkZmpBZVJ6ZHdO
+            dTlDZlk5SHoyeDNjdjJVOG5xa0ZuZGhNSUE4ClN2a1puUm9NTGdXMS9xVDFNN3Vi
+            YTNkemRBR2ZqMTI2Q0VsSU90OXNGNTAKLS0tIDkyRWRYODJKcEExa0JlVVVwaEtH
+            QlFhL0gxZ0FxdVpaZmQ3Q3F4c1JITk0KZxdLfBhiF9i8knoqfx1nE3K5dPtZ8sJ/
+            2LBK7CS0o7BfyLjeBxehboLT2sGv2JFDr/zgVfGo6KPfzuFNDVrYrA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    lastmodified: "2026-08-23T10:41:12Z"
+    mac: ENC[AES256_GCM,data:geILRWPP2+bbSsS0JNQ2FiMSRbYeRWI6eYuKZKvNT8k21xVnVhiW/6+eK+oC1mGlxY5t/MNypdTAzaeNQaB+eMNUDfqDa2YhOcmP2KjabCb1hWqOAm675G83ZMerBZZb5CgwswYNF0HAsYIX6mr1o4zhQjmMhE/0I6eovwmYX9k=,iv:MwCKb/ENFXnG3Plof4krdu4DXkxlmXMMbebX0MXasyc=,tag:FtSRZeffdlpQb44f7z/flg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3