fix(helm): correct secret name references and add migration env var

- Secret resource now named with -secrets suffix to match all template refs
- Add CREDENTIAL_ENCRYPTION_KEY to migration init container (VPN migration needs it)
- Fix postgres secretKeyRef to use -secrets suffix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/helm/templates/api-deployment.yaml

@@ -56,6 +56,11 @@ spec:
                 configMapKeyRef:
                   name: {{ include "tod.fullname" . }}
                   key: SYNC_DATABASE_URL
+            - name: CREDENTIAL_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "tod.fullname" . }}-secrets
+                  key: CREDENTIAL_ENCRYPTION_KEY
           securityContext:
             runAsUser: 1001
             runAsNonRoot: true