chore(k8s): align secrets template with prod secret schema

The towerops-db secret in prod has both DATABASE_URL and individual
POSTGRES_* fields; towerops-redis uses HOST/PORT/PASSWORD instead of
a single REDIS_URL. Update the committed template to match so a fresh
copy of k8s/secrets.example.yaml mirrors what's actually in the
cluster.

k8s/secrets.example.yaml

@@ -40,10 +40,15 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # Full ecto:// URL — used envFrom in the deployment.
+  # Full ecto:// URL — what runtime.exs reads.
   DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
-  # Optional pool tuning (defaults applied in runtime.exs if unset)
-  POOL_SIZE: ""
+  # The individual fields are convenience for ops — not required by the
+  # app but kept here for parity with the existing prod secret.
+  POSTGRES_HOST: ""
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: ""
+  POSTGRES_USER: ""
+  POSTGRES_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret
@@ -63,8 +68,11 @@ metadata:
   namespace: towerops
 type: Opaque
 stringData:
-  # envFrom block injects whatever keys exist here.
-  REDIS_URL: "redis://HOST:6379/0"
+  # K8s pattern — runtime.exs builds the connection from these
+  # individual fields. Dokku alternative is REDIS_URL.
+  REDIS_HOST: ""
+  REDIS_PORT: "6379"
+  REDIS_PASSWORD: ""
 ---
 apiVersion: v1
 kind: Secret