- Secret resource now named with -secrets suffix to match all template refs - Add CREDENTIAL_ENCRYPTION_KEY to migration init container (VPN migration needs it) - Fix postgres secretKeyRef to use -secrets suffix Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>