feat(infra): update SOPS configuration, cloud-init templates, and secondary disk automation (#26)

### Summary of Changes

This PR incorporates the final infrastructure optimizations following
the initial merge of PR #25:

1. **SOPS & Secrets Management**:
- Generated dedicated Age keypair
(`age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl`) and
updated `.sops.yaml`.
- Added SOPS-encrypted production secrets for PostgreSQL
(`ci/k8s/apps/postgres/secret.sops.yaml`) and Umami Analytics
(`ci/k8s/apps/umami/secret.sops.yaml`).
   - Verified 100% clean round-trip decryption.

2. **Cloud-Init Template & Git Safety**:
- Converted `user-data.yaml` into `user-data.template.yaml` with clear
stubs for public SSH keys and private Age keys.
- Added `ci/cloud-init/user-data.yaml` to `.gitignore` to prevent
accidental secret leaks.

3. **Persistent Secondary Storage**:
- Added automated detection, ext4 formatting, and mounting of secondary
persistent disk (`/dev/vdb`) to `/var/lib/rancher/k3s/storage` with
`noatime` in `user-data.template.yaml`.

4. **Golden Image Naming & Workflows**:
- Updated image naming convention to include hyphenated UTC timestamps:
`com-ermnvldmr-debian-12-k3s-amd64-YYYY-MM-DD-HH-MM-SS-sha-<short_sha>.qcow2`.
   - Verified successful CI golden image build and S3 upload.

ci/k8s/apps/umami/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 namespace: com-ermnvldmr
 resources:
   - configmap.yaml
-  - secret.template.yaml
+  - secret.sops.yaml
   - deployment.yaml
   - service.yaml
 images:

ci/k8s/apps/umami/secret.sops.yaml

@@ -0,0 +1,24 @@
+apiVersion: ENC[AES256_GCM,data:vuU=,iv:zpYbCxqVLtsR3u32TCmrWuR2Tsh+MkJU2svi1blu1hI=,tag:JmXQYWJ0mxITglxfofJ6NA==,type:str]
+kind: ENC[AES256_GCM,data:9rg7//dU,iv:Dv5Ezu6iR1vQO7LAaRbp02KAPpYayJlnVINCbmYJTqc=,tag:9/ORm++3ai4cWGVkzksEtw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:4uR03R2de95TVff9IQ==,iv:EVKzFEFpV+JI26z2rrq26Bzm+IvwF+Fz5pbeuGJ69no=,tag:iPkp4SW2n2qxD8jRGzn/Pw==,type:str]
+    namespace: ENC[AES256_GCM,data:nZ3xeCc0z7c+RYrcjA==,iv:lY7t/JpPAZ1XkjfHAyYdCKQPlOwy43L6tU+cPMsMuzI=,tag:1YDH4AZqFEJdki2AV33mRg==,type:str]
+type: ENC[AES256_GCM,data:nSMCLir6,iv:RpZRrH9jlHUv3w+O8w93xAdL313BAFNKSbV20Tx6YfE=,tag:C7yQ9C92tzHbfDjuSjVY9Q==,type:str]
+stringData:
+    APP_SECRET: ENC[AES256_GCM,data:bDL4s2ZTQO8SZnqOHs7AbDZKcXEeEOP0rgq2x6XbNbJeQiyPpT586AXPlxFG2Evj8isayPh4B5Xv9BGWGHgQkQ==,iv:HnRwLJdinB15xScCAj7Mr5iBZZ74e9qwU58t3OTb87Y=,tag:ZXIA7KqtpkTxPBta85R8FQ==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:lNFfvx22Etq97UyLG192//h4iD2LWyz+y2kFUcEPNhiBt63lcZCngzyNRJtp2F9XqHJOCUyzciTZMyP96jQIRNJFusg1BZG/gWrs/eV/40x6aWn8VTZLQdU382DUa7adINo02//w1Jyj35Jlvk7Lx7TycplkFqc=,iv:1Uq8rH6Ih869Udz4Vrjh6k8miue7tMgD7N6Oba7oZmY=,tag:XwtAQvkTphqA5Rckbm9RQA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISnVmeG1oYndJNnNWbkZT
+            YVloQk5YelFrbHZWZm9RTk9VTjNKU3hPazFzCmY2MUYrM1VBc2E0ZHRZWURZcjJa
+            S0VjUS8yV3JISzRWREhxSFBaQ3BoU0UKLS0tIFRpTUpPUWlzaXBETjZjSzZhd1lr
+            NWoxZS9DaGtMSEs5dXdWVElHUjdaMWMK9r5mAJfgvpGGiluxhcO2/uhb8ZhJMIkt
+            N6pnLh/OwrOL7JiTqiERTQHSKrltFuZKuZKqoNCo0dYDzfRCpWHcDw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
+    lastmodified: "2026-08-23T10:41:12Z"
+    mac: ENC[AES256_GCM,data:t4K0VskS20T0fSokIx/7/YwnYAYpD7hTQIS2jNDtv3QtISZ24skrCLA1qMEa6uDqtXHFLa9VsRbH219gu6tTzA/84e547TEfKMSX+LAlv/T6yzxL8Sje9PuZo1wA7alViHtzu0NHKUava3dKzYkJF4sh8tIr/8CGpCvYIIWHXvA=,iv:lLxua+PsyjS0YlLkh5BO0/ZrdiKgktCT/b52IqGiQVU=,tag:kwn6j0XLfaricKEfe6Y6Gw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3