hindsight: Phase C manifests (multi-source app wave 8, external pgvector PG, ES from 1Password, chart-native ingress)

- application.yaml: single multi-source Application (openviking pattern),
  wave 8, chart v0.9.1 via path: + $values/values.yaml
- values.yaml: postgresql.enabled=false (external), existingSecret,
  LLM env (astro-orbiter:8001, Qwen3.8-27B-Q4_K_M), native ingress
  cosmic-rewind.local.mk-labs.cloud (api /health /v1 /mcp /ext, cp /)
- externalsecret.yaml: hindsight-credentials from 1Password mk-labs/hindsight
- namespace.yaml, postgres-pvc.yaml (10Gi nfs-emporium),
  deployment-postgres.yaml (ankane/pgvector pinned by digest),
  service-postgres.yaml (hindsight-postgres:5432)

cluster/applications/hindsight/externalsecret.yaml

@@ -0,0 +1,77 @@
+# ============================================================================
+# ExternalSecret - Hindsight Credentials
+# Peter Parker, Phase C, t_6d47a360
+#
+# Syncs Hindsight credentials from the 1Password `mk-labs` vault (item
+# "hindsight", UUID q6pwoohexogdyvitt7sm2xcusu).
+# Pattern: openviking proven pattern (cluster/platform/openviking/externalsecret.yaml).
+# Store: onepassword-connect ClusterSecretStore.
+# Namespace: hindsight.
+#
+# Wave: -1  — must sync BEFORE the chart's Deployments (which default to wave 0)
+# so the materialized Secret exists before the api / control-plane pods attempt
+# envFrom / secretKeyRef injection.
+#
+# The materialized Secret (hindsight-credentials) must carry keys in TWO shapes
+# (Phase B record: inbox/ryan/2026-08-24-hindsight-phase-b-secrets.md):
+#   1. `postgres-password`  (lowercase, hyphenated) — read by the chart's EXPLICIT
+#      secretKeyRef for POSTGRES_PASSWORD, NOT via envFrom. A naming error here
+#      silently drops the DB password (pod starts, then fails to connect).
+#   2. `HINDSIGHT_API_LLM_API_KEY` / `HINDSIGHT_API_MCP_AUTH_TOKEN` — env-var-named,
+#      injected via envFrom (always runs when existingSecret is set).
+#
+# 1Password item "hindsight" fields (all CONCEALED):
+#   - postgres-password                (32 chars, letters+digits only, URL-safe)
+#   - HINDSIGHT_API_MCP_AUTH_TOKEN     (48 chars urlsafe bearer token)
+#   - HINDSIGHT_API_LLM_API_KEY        (literal "local-placeholder" — astro-orbiter
+#                                       does not validate; must rotate if OpenRouter
+#                                       hosted fallback is ever enabled)
+# ============================================================================
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: hindsight-credentials
+  namespace: hindsight
+  annotations:
+    # Wave -1: ensure the ExternalSecret syncs BEFORE the chart's Deployments
+    # (wave 0). Guarantees the Secret exists before the api / control-plane
+    # pods attempt envFrom / secretKeyRef injection.
+    argocd.argoproj.io/sync-wave: "-1"
+    description: "Phase C secrets for Hindsight deployment (1Password mk-labs item: hindsight)"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: hindsight-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # LOWERCASE, HYPHENATED — read by the chart's explicit secretKeyRef for
+        # POSTGRES_PASSWORD. Must be exactly "postgres-password".
+        postgres-password: "{{ .postgresPassword }}"
+        # env-var-named keys injected via envFrom
+        HINDSIGHT_API_MCP_AUTH_TOKEN: "{{ .HINDSIGHT_API_MCP_AUTH_TOKEN }}"
+        HINDSIGHT_API_LLM_API_KEY: "{{ .HINDSIGHT_API_LLM_API_KEY }}"
+  data:
+    # 1Password item "hindsight", field "postgres-password".
+    # letters+digits only / URL-safe: required because the chart interpolates the
+    # value RAW into HINDSIGHT_API_DATABASE_URL (no URL-encoding).
+    - secretKey: postgresPassword
+      remoteRef:
+        key: hindsight
+        property: postgres-password
+    # 1Password item "hindsight", field "HINDSIGHT_API_MCP_AUTH_TOKEN"
+    # (MCP bearer token, D6 — enables bearer-auth on the /mcp endpoint)
+    - secretKey: HINDSIGHT_API_MCP_AUTH_TOKEN
+      remoteRef:
+        key: hindsight
+        property: HINDSIGHT_API_MCP_AUTH_TOKEN
+    # 1Password item "hindsight", field "HINDSIGHT_API_LLM_API_KEY"
+    # (literal "local-placeholder" — astro-orbiter does not validate, D1)
+    - secretKey: HINDSIGHT_API_LLM_API_KEY
+      remoteRef:
+        key: hindsight
+        property: HINDSIGHT_API_LLM_API_KEY