Single Secret with all sensitive values (JWT, encryption keys, DB passwords, SMTP credentials, poller DB URL). Single ConfigMap with all non-sensitive config including URL helpers and optional value guards. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>