deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)

- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore

k8s/kustomization.yaml

@@ -1,14 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- namespace.yaml
-- configmap.yaml
-- deployment.yaml
-- service.yaml
-- ingress.yaml
+  - namespace.yaml
+  - configmap.yaml
+  - externalsecret-registry.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
 
 # CI updates newTag to the immutable git-sha via `kustomize edit set image` (see .gitea/workflows/ci.yml).
+# Name is the public HTTPS pull endpoint that k3s uses.
 images:
-- name: 10.66.15.22:3000/bmr_bluecap/bcs-website
-  newName: 10.66.15.22:3000/bmr_bluecap/bcs-website
-  newTag: 79f2e8a78b9f
+  - name: git.7tl-homelab.com/bmr_bluecap/bcs-website
+    newTag: latest