Enable Reloader secret watching, scope existing auto to configmap-only (#326)

The internal intermediate CA re-key broke CA consumers because Reloader
ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling
generic secret watching naively would restart every workload on each
Vault/VSO secret rotation, so this scopes existing auto annotations to
ConfigMaps and makes secret reload opt-in per Secret.

- set reloader ignoreSecrets: false so Secrets are watched
- convert every generic reloader.stakater.com/auto to the configmap-only
  configmap.reloader.stakater.com/auto form (22 annotations, 19 files)
- add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA
  consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler,
  litellm, logarchiver) so CA rotation restarts them
- add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager
  leaf renewal rolls kanidm
- add docs/ca-rotation.md runbook and index it

Closes #326

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

docs/README.md

@@ -8,3 +8,4 @@ Operational notes for the manifests in this repo.
 | [cnpg-restore.md](cnpg-restore.md) | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
 | [authentik-rancher-sso.md](authentik-rancher-sso.md) | Manual runtime step to point Rancher's OIDC auth at the canonical `identity.unkin.net` issuer and trust the internal CA. |
 | [gitea-migration.md](gitea-migration.md) | Staged cutover of the git.unkin.net forge from the Puppet VM to the `gitea` namespace. |
+| [ca-rotation.md](ca-rotation.md) | Rolling the internal `unkin.net` PKI CA (`vault-ca-cert`): what Reloader restarts automatically vs. manual/CNPG restarts. |