Remove secretGenerator from kustomization for GitOps compatibility

Secrets are now managed directly in the cluster rather than generated
from .envrc files. This fixes FluxCD reconciliation errors since .envrc
is gitignored and cannot be used in GitOps workflows.

All secrets have been backed up to 1Password for disaster recovery.

k8s/README.md

@@ -2,20 +2,15 @@
 
 ## Secrets Management
 
-Secrets are stored in `.envrc` files (gitignored):
-- Project root `.envrc` - Used by direnv for local development
-- `k8s/.envrc` - Used by Kustomize for secret generation
+Secrets are managed directly in the cluster and must be created before deploying the application.
 
-Kustomize automatically generates the `towerops-sendgrid` Secret from `k8s/.envrc` using the `secretGenerator` in `kustomization.yaml`.
+Required secrets in the `towerops` namespace:
+- `gitlab-registry` - Docker registry credentials for pulling images
+- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE)
+- `towerops-db` - Database connection credentials
+- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION)
 
-Both `.envrc` files should contain:
-```bash
-# SendGrid Configuration
-SENDGRID_API_KEY=your-api-key-here
-export SENDGRID_API_KEY
-```
-
-The KEY=VALUE format works for both Kustomize and direnv.
+For local development, the project root `.envrc` is used by direnv.
 
 ## Deploying
 

k8s/kustomization.yaml

@@ -8,10 +8,3 @@ resources:
   - service-headless.yaml
   - certificate.yaml
   - ingressroute.yaml
-
-secretGenerator:
-  - name: towerops-aws
-    envs:
-      - .envrc
-    options:
-      disableNameSuffixHash: true