deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)

- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore

k8s/deployment.yaml

@@ -13,14 +13,15 @@ spec:
       labels:
         app: bluecap-website
     spec:
-      # If the Gitea package is PRIVATE, create a docker-registry secret (ideally via
-      # External Secrets) named `gitea-registry` in this namespace and uncomment:
-      # imagePullSecrets:
-      #   - name: gitea-registry
+      # Private Gitea package -> pull auth from the External-Secrets-managed dockerconfigjson
+      # (see k8s/externalsecret-registry.yaml).
+      imagePullSecrets:
+        - name: gitea-registry
       containers:
         - name: website
-          # Tag is managed by CI via kustomize (see k8s/kustomization.yaml `images`).
-          image: 10.66.15.22:3000/bmr_bluecap/bcs-website:latest
+          # Pulled over public HTTPS (valid cert -> no node registry config). Tag managed by CI
+          # via kustomize (see k8s/kustomization.yaml `images`).
+          image: git.7tl-homelab.com/bmr_bluecap/bcs-website:latest
           imagePullPolicy: IfNotPresent
           ports:
             - name: http