Fix k8s Secret manifest with plaintext CHANGE_ME placeholders

[Wilfred007]

What

backend-secret.yaml is committed to git with stringData containing CHANGE_ME placeholders for DATABASE_URL, JWT_SECRET, STELLAR_SECRET_KEY. Anyone who deploys without overriding runs with known credentials.

Why

Known credentials in a payroll system is a critical security issue. The secret should use an external secret manager.

Scope

In scope: Use Sealed Secrets or External Secrets Operator, remove plaintext from git, document safe-apply workflow
Out of scope: Vault setup

Acceptance Criteria

• No plaintext secrets in git
• External secret manager integration
• Safe-apply workflow documented
• Deployment fails if secrets not configured

Technical Context

• k8s/base/backend-secret.yaml — plaintext placeholders
• infrastructure/terraform/modules/secrets/ — AWS Secrets Manager