fix(coturn): remove plaintext TURN shared secret, rotate leaked value

Issue #38 discussion surfaced a real bug: the TURN shared secret was
duplicated - correctly SOPS-encrypted in coturn-secret.yaml, but also
hardcoded in plaintext in synapse-values.yaml (a plain, non-SOPS
ConfigMap), visible in git history. Also found turn_user_lifetime is
86400000ms (24h), not "short-lived" as previously assumed - raising the
stakes of the leak somewhat.

Extracted the turn config block into its own dedicated SOPS-encrypted
Secret (synapse-turn-secret.yaml), wired via a second HelmRelease
valuesFrom entry (same pattern already used for ess-mas-values-secret).
Rotated the value while doing this, so the leaked plaintext secret is no
longer live anywhere.

Added checksum/rotated-at annotations (matrix-stack HelmRelease's
existing element-config-checksum patch gets a sibling turn-secret-checksum;
coturn's Deployment pod template gets a rotated-at annotation) so future
rotations actually restart both consumers - Kubernetes doesn't restart
running pods when a referenced Secret's content changes on its own.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/production/kustomization.yaml

@@ -1,8 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Patch: Fügt einen Checksum der element-values.yaml zur HelmRelease hinzu
-# Damit wird Flux die HelmRelease neu-synced wenn sich die ConfigMap ändert
+# Patch: Fügt Checksums der element-values.yaml und des turn_shared_secret zur
+# HelmRelease hinzu. Damit wird Flux die HelmRelease neu-synced (und synapse-main neu
+# gestartet), wenn sich die jeweilige ConfigMap/Secret ändert - siehe Issue #38's
+# Rotations-Mechanismus, der turn-secret-checksum bei jeder Rotation bumpt.
 patches:
   - target:
       kind: HelmRelease
@@ -12,6 +14,9 @@ patches:
       - op: add
         path: /metadata/annotations/element-config-checksum
         value: "401f8a87d0ef5d91d2e5032d4aede42c"
+      - op: add
+        path: /metadata/annotations/turn-secret-checksum
+        value: "9b0383df36943da3b32198b6bd32bfcd"
 
 resources:
   - matrix-postgres-auth.yaml
@@ -26,6 +31,7 @@ resources:
   # TURN Server für WebRTC
   - coturn-secret.yaml
   - coturn.yaml
+  - synapse-turn-secret.yaml
   # HelmRelease (muss ganz unten stehen, damit die ConfigMaps vorher da sind!)
   - element-server-suite.yaml
   # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat