Stop versioning the real secret.yaml

k8s/secret.yaml held the actual PostgreSQL password, Keycloak admin
password and OIDC client secrets, and .gitignore only covered .DS_Store
and *.tmp. Untrack it and ignore it, matching what infra-librechat already
does, and extend the ignore list to TLS key material.

kustomization.yaml still references the file, so the README now documents
creating it from secret.example.yaml — whose key set is identical — before
the first apply.

This only stops future leaks. The values remain in commit 6d3431c and on
the remote, so they must still be treated as compromised and rotated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -1,2 +1,12 @@
 .DS_Store
 *.tmp
+
+# Real secrets: only secret.example.yaml is versioned.
+# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must
+# create it first — see README.
+k8s/secret.yaml
+
+# TLS material
+*.crt
+*.key
+*.pem

k8s/README.md

@@ -42,6 +42,18 @@ k8s/
 
 ## Déploiement
 
+`k8s/secret.yaml` n'est pas versionné : il porte les mots de passe réels (base
+PostgreSQL, admin Keycloak, secrets clients OIDC). Le créer une fois depuis le
+gabarit, puis renseigner chaque `<CHANGE_ME>` :
+
+```bash
+cp k8s/secret.example.yaml k8s/secret.yaml
+$EDITOR k8s/secret.yaml
+```
+
+`k8s/kustomization.yaml` le référence, donc le déploiement échoue tant qu'il
+est absent.
+
 ```bash
 kubectl apply -k k8s/
 ```