feat: a second environment-secret slot

A deployment's workflow environment usually comes from more than one owner —
credentials the platform holds, and credentials the workflows' own estate holds.
Both slots are optional, so an unused one needs no placeholder Secret.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/deployment.yaml

@@ -78,8 +78,17 @@ spec:
             # Whatever else this deployment's workflows need in their
             # environment. Provided by the deployment, not by this repo: an
             # empty Secret of that name is a valid answer.
+            #
+            # Two slots rather than one, because a deployment's environment
+            # usually comes from more than one owner — credentials the platform
+            # holds, and credentials a workflow's own estate holds. Both are
+            # marked optional, so an unused slot needs no placeholder Secret.
             - secretRef:
                 name: ${EXTRA_ENV_SECRET}
+                optional: true
+            - secretRef:
+                name: ${EXTRA_ENV_SECRET_2}
+                optional: true
           volumeMounts:
             - name: data
               mountPath: /home/node/.n8n