Enable Reloader secret watching, scope existing auto to configmap-only (#326)

The internal intermediate CA re-key broke CA consumers because Reloader
ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling
generic secret watching naively would restart every workload on each
Vault/VSO secret rotation, so this scopes existing auto annotations to
ConfigMaps and makes secret reload opt-in per Secret.

- set reloader ignoreSecrets: false so Secrets are watched
- convert every generic reloader.stakater.com/auto to the configmap-only
  configmap.reloader.stakater.com/auto form (22 annotations, 19 files)
- add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA
  consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler,
  litellm, logarchiver) so CA rotation restarts them
- add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager
  leaf renewal rolls kanidm
- add docs/ca-rotation.md runbook and index it

Closes #326

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/puppet/deployment_puppetboard.yaml

@@ -21,7 +21,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetboard
         app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetdb.yaml

@@ -20,7 +20,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetdb
         app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetserver-compiler.yaml

@@ -2,7 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
   labels:
     app.kubernetes.io/component: puppetserver-compilers
     app.kubernetes.io/instance: puppetserver

apps/base/puppet/deployment_puppetserver-master.yaml

@@ -2,7 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   annotations:
-    reloader.stakater.com/auto: "true"
+    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
   labels:
     app.kubernetes.io/component: puppetserver
     app.kubernetes.io/instance: puppetserver
@@ -20,7 +21,7 @@ spec:
   template:
     metadata:
       annotations:
-        reloader.stakater.com/auto: "true"
+        configmap.reloader.stakater.com/auto: "true"
       labels:
         app.kubernetes.io/component: puppetserver
         app.kubernetes.io/instance: puppetserver