migrate consuming stacks to ESO + remove k8s-dashboard static token

Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin

stacks/wealthfolio/main.tf

@@ -4,11 +4,6 @@ variable "tls_secret_name" {
 }
 variable "nfs_server" { type = string }
 
-data "vault_kv_secret_v2" "secrets" {
-  mount = "secret"
-  name  = "wealthfolio"
-}
-
 # To refresh transactions use finance db positions exporters:
 #
 # workon finace-app && cd ~/code/finance && python main.py fetch position --imap-user=$IMAP_USER --imap-password=$IMAP_PASSWORD --trading212-api-keys=$TRADING212_API_KEYS --output-file positions.csv && mv positions.csv /home/wizard/code/infra/modules/kubernetes/wealthfolio/updated_trades.csv
@@ -26,6 +21,33 @@ resource "kubernetes_namespace" "wealthfolio" {
   }
 }
 
+resource "kubernetes_manifest" "external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "wealthfolio-secrets"
+      namespace = "wealthfolio"
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-kv"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "wealthfolio-secrets"
+      }
+      dataFrom = [{
+        extract = {
+          key = "wealthfolio"
+        }
+      }]
+    }
+  }
+  depends_on = [kubernetes_namespace.wealthfolio]
+}
+
 module "tls_secret" {
   source          = "../../modules/kubernetes/setup_tls_secret"
   namespace       = kubernetes_namespace.wealthfolio.metadata[0].name
@@ -53,6 +75,9 @@ resource "kubernetes_deployment" "wealthfolio" {
       app  = "wealthfolio"
       tier = local.tiers.aux
     }
+    annotations = {
+      "reloader.stakater.com/auto" = "true"
+    }
   }
   spec {
     replicas = 1
@@ -79,8 +104,13 @@ resource "kubernetes_deployment" "wealthfolio" {
             value = "0.0.0.0:8080"
           }
           env {
-            name  = "WF_AUTH_PASSWORD_HASH"
-            value = data.vault_kv_secret_v2.secrets.data["password_hash"]
+            name = "WF_AUTH_PASSWORD_HASH"
+            value_from {
+              secret_key_ref {
+                name = "wealthfolio-secrets"
+                key  = "password_hash"
+              }
+            }
           }
           env {
             name  = "WF_DB_PATH"