fire-planner: expose actualbudget creds via ExternalSecret

Adds 3 new keys (ACTUALBUDGET_API_URL/KEY/SYNC_ID) sourced from
Vault secret/fire-planner so the FastAPI backend can read viktor's
spending from the in-cluster actualbudget HTTP API and prefill the
Annual spending field on the WhatIf form. Vault keys seeded manually
ahead of this commit; ESO has already synced the K8s Secret.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

stacks/fire-planner/main.tf

@@ -77,6 +77,27 @@ resource "kubernetes_manifest" "external_secret" {
             property = "recompute_bearer_token"
           }
         },
+        {
+          secretKey = "ACTUALBUDGET_API_URL"
+          remoteRef = {
+            key      = "fire-planner"
+            property = "actualbudget_api_url"
+          }
+        },
+        {
+          secretKey = "ACTUALBUDGET_API_KEY"
+          remoteRef = {
+            key      = "fire-planner"
+            property = "actualbudget_api_key"
+          }
+        },
+        {
+          secretKey = "ACTUALBUDGET_SYNC_ID"
+          remoteRef = {
+            key      = "fire-planner"
+            property = "actualbudget_sync_id"
+          }
+        },
       ]
     }
   }