docs(kubernetes): document sourcing the encryption keypair from a Secret

[pat-s]

Documents sourcing the encryption keypair from a Kubernetes Secret instead of the home volume, which is what a second server replica needs.

AI Summary

Why

The secrets configuration key landed in ricochet-rs/ricochet#1308 and had no operator-facing documentation.
It was written up in ricochet-rs/ricochet#1309 as docs/ha-deployment.md, a file in the application repository that no self-hoster would ever land on; that pull request is closed and the content is ported here instead.

The draft there was also written against the design rather than the merged code, and described a [secrets] section with a dir field.
What shipped is a top-level secrets key, so this page documents RICOCHET_SECRETS and the real Helm values.

dev/admin/installation/3-kubernetes.mdx

A new Encryption keys section after Persistence:

• Why the keypair matters: losing .ricochet.json orphans every encrypted environment variable and git credential.
• ricochet secrets-init --dir into a scratch directory, kubectl create secret generic, then remove the on-disk copy.
• The extraVolumes / extraVolumeMounts / env values that mount it and set RICOCHET_SECRETS.
• That .ricochet.pub is derived and never read back, so the Secret does not need it.
• A caution against running secrets-init for an instance that already holds data, with copying the existing .ricochet.json as the migration path.

dev/admin/configuration/0-overview.mdx

Three lines in the storage section pointing at the new anchor, since that page is where RICOCHET_HOME is explained.

Validation

The values block is rendered output, not a guess: helm template against ricochet-rs/helm at 326e151 with exactly those values puts RICOCHET_SECRETS, the /etc/ricochet/secrets mount and the ricochet-keys volume on the server container.

The behavior statements were read off main in the application repository: RicochetConfig::secrets_dir, the any_encrypted_values gate in RicochetProxy::from_config that chooses load over load_or_generate, and SecretsWriteError::AlreadyExists.

bun astro build completes and the link validator reports all internal links valid, which covers the new anchor.
prek run is clean on both files.

[ricochet-bot]

Surge PR preview deployment succeeded. View it at https://ricochet-rs-docs-pr-350.surge.sh

[JosiahParry]

Addreessing

[pat-s]

Did some additional cleanup. @JosiahParry good to merge or do you need another round?