migrate consuming stacks to ESO + remove k8s-dashboard static token

Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin

stacks/openclaw/main.tf

@@ -31,6 +31,33 @@ module "tls_secret" {
   tls_secret_name = var.tls_secret_name
 }
 
+resource "kubernetes_manifest" "external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "openclaw-secrets"
+      namespace = "openclaw"
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-kv"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "openclaw-secrets"
+      }
+      dataFrom = [{
+        extract = {
+          key = "openclaw"
+        }
+      }]
+    }
+  }
+  depends_on = [kubernetes_namespace.openclaw]
+}
+
 resource "kubernetes_service_account" "openclaw" {
   metadata {
     name      = "openclaw"
@@ -296,6 +323,9 @@ resource "kubernetes_deployment" "openclaw" {
         labels = {
           app = "openclaw"
         }
+        annotations = {
+          "reloader.stakater.com/search" = "true"
+        }
       }
       spec {
         service_account_name = kubernetes_service_account.openclaw.metadata[0].name
@@ -398,8 +428,13 @@ resource "kubernetes_deployment" "openclaw" {
             value = "http://claude-memory.claude-memory.svc.cluster.local"
           }
           env {
-            name  = "MEMORY_API_KEY"
-            value = data.vault_kv_secret_v2.secrets.data["claude_memory_api_key"]
+            name = "MEMORY_API_KEY"
+            value_from {
+              secret_key_ref {
+                name = "openclaw-secrets"
+                key  = "claude_memory_api_key"
+              }
+            }
           }
           # Python packages path for skills
           env {
@@ -456,12 +491,22 @@ resource "kubernetes_deployment" "openclaw" {
             container_port = 7352
           }
           env {
-            name  = "NVIDIA_API_KEY"
-            value = data.vault_kv_secret_v2.secrets.data["nvidia_api_key"]
+            name = "NVIDIA_API_KEY"
+            value_from {
+              secret_key_ref {
+                name = "openclaw-secrets"
+                key  = "nvidia_api_key"
+              }
+            }
           }
           env {
-            name  = "OPENROUTER_API_KEY"
-            value = data.vault_kv_secret_v2.secrets.data["openrouter_api_key"]
+            name = "OPENROUTER_API_KEY"
+            value_from {
+              secret_key_ref {
+                name = "openclaw-secrets"
+                key  = "openrouter_api_key"
+              }
+            }
           }
           volume_mount {
             name       = "tools"
@@ -913,12 +958,22 @@ resource "kubernetes_cron_job_v1" "task_processor" {
               ]
 
               env {
-                name  = "FORGEJO_TOKEN"
-                value = data.vault_kv_secret_v2.secrets.data["forgejo_api_token"]
+                name = "FORGEJO_TOKEN"
+                value_from {
+                  secret_key_ref {
+                    name = "openclaw-secrets"
+                    key  = "forgejo_api_token"
+                  }
+                }
               }
               env {
-                name  = "OPENCLAW_TOKEN"
-                value = data.vault_kv_secret_v2.secrets.data["nvidia_api_key"]
+                name = "OPENCLAW_TOKEN"
+                value_from {
+                  secret_key_ref {
+                    name = "openclaw-secrets"
+                    key  = "nvidia_api_key"
+                  }
+                }
               }
 
               resources {