fix: SOPS-encrypt waitlist secrets with age key

- DB password: random 48-char hex string
- admin_api_key: random 32-char hex string
- Telegram bot_token/chat_id still CHANGEME — fill before deploying

apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml

@@ -5,9 +5,25 @@ metadata:
     namespace: customer1
 type: Opaque
 stringData:
-    username: waitlist
+    username: ENC[AES256_GCM,data:Gla9qDWPnL4=,iv:fOFJEBrZ2C6UChUhIKbG3pcO0Zkiv0WGybWoW+5UOXU=,tag:5QulFOKmUb8g89Ssv/4pKg==,type:str]
-    password: CHANGEME
+    password: ENC[AES256_GCM,data:fMajWmKxkD2ezhLfSvnGG3lMabgVSHCCr9ORtVnj7apfW9L3+xaVI3b0sYJD4vP7,iv:6qs2FTP7GuNCFB2YyK77MDtYLrcC+WuiWpo6NmTH7EE=,tag:ppcc4+aBDJL0akE02Q5n7g==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVJZT2twOHFDRHgzaWVm
+            WWcxODRhSG5jSTNITnZsRHR1dnB6NVpqMFN3CkxUMElMcEN4dEdrZXQ4Z1dkMk9G
+            ZWYrTGFkMHhrb3UrUWJYRTlzc0xiS0EKLS0tICtLNC9qZk5VSnE3K3NtUGx6USsv
+            a3hXaG1rYlI5ampRSlFXWktTSzhtem8KVRHAel5jBPiMMDT7bYboorkryiuvdjOL
+            +uD/aMZT04vyeG9i1d4peeab/NP8jmnxWKJOftGKN3PIqPYrZ6OHCQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-15T01:35:29Z"
+    mac: ENC[AES256_GCM,data:s3/3/oKVNisc9LVUUzbMPvnaPTR3DJ0pPzYQpxCKkVJ7Cu0GOOsWQBUsgB3wfzLAWSGD2vTYLabzczTRXTkwq5R66ySv1FUOJjAxnZJhwLqcST5+wSzzNczEMbJFBhZepPUNZsMuqkHElQ5f3xZIfo71QITBmrdtg3wEvkHqPrM=,iv:ItkjTFniNlhx3PGoIZUXMtOpBNE5MyqElMFE9rojkOc=,tag:KGW3lD++RvI46lDUTmc7SA==,type:str]
+    pgp: []
     encrypted_regex: ^(data|stringData)$
+    version: 3.9.0

apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml

@@ -5,10 +5,26 @@ metadata:
     namespace: customer1
 type: Opaque
 stringData:
-    bot_token: CHANGEME
+    bot_token: ENC[AES256_GCM,data:Oc0SMrjZpO0=,iv:7MUe7Ew4Hvmp83AYVhz6yyX431NckEwK2lEfuxqFqKA=,tag:MTIs8XDzxNbHll9MiEdGlw==,type:str]
-    chat_id: CHANGEME
+    chat_id: ENC[AES256_GCM,data:TmRBJWB7gHo=,iv:DDEdFefsw4zmhLfGpO8OMI0VR1J81GBatSGnkZMKgDI=,tag:n2gJwD873wMagBFaxv2sxQ==,type:str]
-    admin_api_key: CHANGEME
+    admin_api_key: ENC[AES256_GCM,data:S3VdB11Z37hxz1gIRCODkO36ZdoaifDGx1QmmCKOf8k=,iv:FvoGOdAf6Mzf+riWOx780M6zoGK6ApxX5/0iD+bKi1U=,tag:xNoL74kDhI1Fmu4HGAXC/g==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
         - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvcUpOeVdGb2JZbjFZT2gx
+            RVgya2lKQitaM0RoYnNQU1JtWlQxR3F1c3dFCmVnWlFTOE5SVTVKWnZSdlUrdDhN
+            NVo5MzdMMUdlb0JRZEFBajgyem5QM3cKLS0tICtDQXNpc2U4eUJ2SENZNHB5WWYx
+            UFlpVS9kU3lGVzJCT2w3M09POE8vK2MKy9hUP+R7LyguASYwszy7emzoETUfn3EG
+            qdppIQNIF0r6We6khq2IMkRM1ubPKKoMUYXjLtNyfuteuV7YcsTbmw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-15T01:35:29Z"
+    mac: ENC[AES256_GCM,data:7CuKClWk42TxcCVHWn3tAUAqefEbAtF9eGp59WPwBlMWsQwwL37CavCnofq2bF3G+k1ZrvaHwwdIe5kacQmD+cx3p97+Df5FImQcuu+nnzYQH9GnpoqrBIC6UC4LTbD7se/vGNCK7P8lMLumbRy2/GCiEttCYNhneF0AQiHQIzs=,iv:G/3Ejb0aMMJgyybcLGLEdPLsRzYxnPL1acDBLogfWxM=,tag:OFSyTwoVlkP3s2tc3F9uZg==,type:str]
+    pgp: []
     encrypted_regex: ^(data|stringData)$
+    version: 3.9.0