Split AUTH_SECRET into its own ExternalSecret for group-wishlist

[bkonicek]

Summary

• AUTH_SECRET was templated into the same app-secrets ExternalSecret as the 1Password-sourced Google OAuth creds, sourced from a stateless Password generator. Since generators re-run on every reconcile, every refreshInterval tick (1h) minted a brand-new AUTH_SECRET, silently rotating the Secret under already-running pods and invalidating every active Auth.js JWT session roughly once an hour.
• Split AUTH_SECRET into its own auth-secret ExternalSecret with refreshInterval: 0, so it's generated once and left alone. app-secrets now only carries AUTH_GOOGLE_ID/AUTH_GOOGLE_SECRET from 1Password and keeps syncing normally, so those can still rotate live.

Test plan

• helm template charts/group-wishlist renders both ExternalSecrets correctly
• ArgoCD sync picks up auth-secret Secret in the group-wishlist namespace
• App values wired to reference the new auth-secret Secret for AUTH_SECRET
• Confirm sessions no longer get invalidated after an hour

🤖 Generated with Claude Code

[github-actions]

Argo CD Diff Preview

Summary:

Modified (1):
± sandbox-oci-group-wishlist (+21|-6)

sandbox-oci-group-wishlist (applications/appset-ops-tools.yaml)

ExternalSecret: app-secrets

   name: app-secrets
 spec:
   dataFrom:
-  - sourceRef:
-      generatorRef:
-        apiVersion: generators.external-secrets.io/v1alpha1
-        kind: Password
-        name: auth-secret
   - extract:
       key: group-wishlist-config
   secretStoreRef:
@@ skipped 5 lines (14 -> 18) @@
       data:
         AUTH_GOOGLE_ID: '{{ .AUTH_GOOGLE_ID }}'
         AUTH_GOOGLE_SECRET: '{{ .AUTH_GOOGLE_SECRET }}'
-        AUTH_SECRET: '{{ .authSecretRaw | b64enc }}'
       type: Opaque

ExternalSecret: auth-secret

+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: auth-secret
+spec:
+  dataFrom:
+  - sourceRef:
+      generatorRef:
+        apiVersion: generators.external-secrets.io/v1alpha1
+        kind: Password
+        name: auth-secret
+  refreshInterval: 0
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: 1password
+  target:
+    name: auth-secret
+    template:
+      data:
+        AUTH_SECRET: '{{ .authSecretRaw | b64enc }}'
+      type: Opaque

Stats:
[Applications: 34], [Full Run: 1m17s], [Rendering: 26s], [Cluster: 20s], [Argo CD: 32s]