fix(helm): correct secret name references and add migration env var

- Secret resource now named with -secrets suffix to match all template refs
- Add CREDENTIAL_ENCRYPTION_KEY to migration init container (VPN migration needs it)
- Fix postgres secretKeyRef to use -secrets suffix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

infrastructure/helm/templates/secrets.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "tod.fullname" . }}
+  name: {{ include "tod.fullname" . }}-secrets
   labels:
     {{- include "tod.labels" . | nindent 4 }}
 type: Opaque