chore(k8s): live config values in overlay, script to fill missing secrets

- overlays/encry configmaps now carry the live cluster values (runbook
  step 1) plus OIDC_CLIENT_ID; kubectl diff against the cluster is empty.
- deploy/k8s/scripts/ensure-secrets.sh adds missing secret keys without
  touching existing ones (random encryption keys, empty Open-Meteo key,
  TELEGRAM_BOT_TOKEN=dummy) and never prints values.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/overlays/encry/configmap-frontend.yaml

@@ -5,4 +5,4 @@ kind: ConfigMap
 metadata:
   name: apicore-frontend-config
 data:
-  API_URL: "https://api.apicore.example.com/api/v1"
+  API_URL: "https://apicorebackend.encry.de/api/v1"