Enable Reloader secret watching, scope existing auto to configmap-only (#326)

The internal intermediate CA re-key broke CA consumers because Reloader
ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling
generic secret watching naively would restart every workload on each
Vault/VSO secret rotation, so this scopes existing auto annotations to
ConfigMaps and makes secret reload opt-in per Secret.

- set reloader ignoreSecrets: false so Secrets are watched
- convert every generic reloader.stakater.com/auto to the configmap-only
  configmap.reloader.stakater.com/auto form (22 annotations, 19 files)
- add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA
  consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler,
  litellm, logarchiver) so CA rotation restarts them
- add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager
  leaf renewal rolls kanidm
- add docs/ca-rotation.md runbook and index it

Closes #326

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/age-api/deployment.yaml

@@ -12,7 +12,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app: age-api
     spec: