Fix ExternalSecret API format and deployment env vars

- ExternalSecret: use key/property format (not path) for 1Password reference
- Deployment: remove admin password env var (use single vllm-api-key)
- Syncs vLLM API key from op://mk-labs/vllm/api-key

cluster/applications/body-wars/deployment.yaml

@@ -39,12 +39,6 @@ spec:
               name: body-wars-secret
               key: vllm-api-key
               optional: false
-        - name: OAUTH_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: body-wars-secret
-              key: openwebui-admin-password
-              optional: false
         # Backend configuration for vLLM
         - name: OLLAMA_BASE_URLS
           value: "http://astro-orbiter:8000"

cluster/applications/body-wars/externalsecret.yaml

@@ -9,8 +9,8 @@ metadata:
 spec:
   refreshInterval: 1h
   secretStoreRef:
-    name: onepassword-connect
     kind: ClusterSecretStore
+    name: onepassword-connect
   target:
     name: body-wars-secret
     creationPolicy: Owner
@@ -18,11 +18,9 @@ spec:
       engineVersion: v2
       data:
         vllm-api-key: "{{ .vllm_api_key }}"
-        openwebui-admin-password: "{{ .openwebui_admin }}"
   data:
+    # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
     - secretKey: vllm_api_key
       remoteRef:
-        path: mk-labs/vllm/api-key
+        key: vllm
-    - secretKey: openwebui_admin
+        property: api-key
-      remoteRef:
-        path: mk-labs/openwebui/admin-password