feat(coturn): add scoped age recipient for automated rotation job

Adds a second age recipient (dedicated keypair, private key never touches
the repo) to just these two files, so the upcoming rotation CronJob can
decrypt/re-encrypt them without needing the repo's master sops-age key,
which can decrypt every secret in the repo. Verified: master key still
decrypts both files; the new scoped key can decrypt both files but
correctly cannot decrypt an unrelated secret (authentik-secret.yaml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/production/coturn-secret.yaml

@@ -4,19 +4,28 @@ metadata:
     name: coturn-secret
     namespace: matrix
 stringData:
-    TURN_SECRET: ENC[AES256_GCM,data:XTkWEymgB8wz7yoXMXFkmwoTlQuW4dc7Z34UnONvKB5Qi+Wa3yVdACnFrnvE1HnzWYJ23YO+ssCNXRiixl9YVg==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:KKMuQm41ZuvvjTzGpScbIA==,type:str]
+    TURN_SECRET: ENC[AES256_GCM,data:ZLp9/NqMZ+nrU8hUdwKndBjBh6Qa94O3UUuT71E8XDt5mP6+uZeVab27IqssqNJ6+T9tuj5uw5Q9Pj3NK6rERw==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:5/LDvbVVj+a5TLjLBci1Dw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRk1mK3NWc1l4T0JCOFpF
-            S0RuQ3ViZmo3QTNVL2JvZ0hzMy91R2l0TEhzCk01a1VGdk1sdVg4aWswTzRibXI4
-            ZlJtNFF5MjBONEZOaWVpeU5taHl2bkEKLS0tIGxpUHY3NUFLWFBaWm1QSlZiVFkx
-            MEJleHFnd3oyT3VPL2dsYkpMUlRkOWMKcKUIgsQ/ff49pGGXMnYwJmwqPVC7woAR
-            IEzvhcNX97xx746SnrxZe5t2YadsYMkYIl0nvqBPJhSlvqMNafpQbQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQMncxOEhRZC9jcHpjT3dW
+            Q1RNaW5pc00zVnJhWHRnZHd3TGhURWNZU2dJCk85bXJkbTEyd1ZybjhDT05pL2c3
+            ZU9EUSt1eDlSQWJyVGtsak1oS3FSR2sKLS0tIEFUdXVHL0V1ZW5VMVVBZEJaYUIw
+            U1BrYlJyQVZkZFhBdmdwbDMyK3lTQkkKEaSy1o+IICf2uaT6olapRJa/duXxjOBg
+            OqRS9axnJ71XxEnHjLTsCbkI5b+8Fux08qKaH9sMsJrWOiSHDdTXXQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQk82eGdWRmdRNFJQR0xF
+            SWhNRUtNWThZNFM0aXU3V0N4UkhtTy9NTFdnCi9pa3dsVXRja1dTL1pZTnoxQ0JT
+            UUIxekZnVGUvdFgyblFiS0JLMjU3L2cKLS0tIE1IRTJ0M3kvMFZPWVVDYjJlVkk0
+            eGJQOTVUc1NsNE5GdmJtODlmdHp3c2cKHTP6YRMTdYE/iBuSZs/Tjt4TwKCxHEIu
+            f3jTblKIqWwRHKCgOIkC16QDbpMBlNLH3JknJEdIjkB2HIrXrw1MNA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-28T19:02:42Z"
-    mac: ENC[AES256_GCM,data:1NO8bBG47PDK5zGBYVvfUHjbLct9DP3eBDurtd7ChGFiQBPRUrlLric2cfUuB54+Z1x+VV2WIEpVt6gARNcG6+gc6H+ZKZZL1PRj3Pl3NYhgbjs05R/cHYAg3QimmnuvQlM8MvZGimB48l6mkvIN+ncmoB6l/6AXG1XfmwFW87o=,iv:AABJu2TglH2nB8PMV7ORpQ0EyzznrwmgpWImvm9mB6o=,tag:md5aQyK72iL+P28y/YDqLQ==,type:str]
+    lastmodified: "2026-07-28T19:13:00Z"
+    mac: ENC[AES256_GCM,data:i2dEOiO1K1RNoGgkJyZf7eGix0yaqSwbeE1NOQf72alyA8bM8p5ufz6X2P49OUmw2d8vjsJ40sTTSUcnI2/ZoeFJ24jEN7N6pVj2Wy9DkBynIlnPWvVxa347T6/yToPp3neLreH1ap+I50FUcnK50hS+TpRHtSW+9Js5oxrJxTQ=,iv:yFmrcDr2gW1EJRNSSQ8Ie3PXS4bNFqiK5Bbvy6IGlHE=,tag:G1vn8StyJFpl+duZHb0vPg==,type:str]
     version: 3.12.2

apps/production/synapse-turn-secret.yaml

@@ -4,19 +4,28 @@ metadata:
     name: synapse-turn-secret
     namespace: matrix
 stringData:
-    values.yaml: ENC[AES256_GCM,data:fFKCOus4okAo98WwfNkbdLyBFfkp9C1znMeSHh/Og6Z/rRbivsHeKFYjW3O0rHOy9kds/mtWxE4f7ealjY+5gsslwi/Rzp56AD4O+m7OEs5wcIVQsv8UT5IkUDbrYE3LJwMrl+sqw/jmZ1BR22a2ZEYGk3r1Y5S/gDI99AiydwUiYdOueSCRQg6AEEr6LDR898J8ZVcMlaRZ+4ZkbVrIZcuKN6oxq3eqPR3kugIMjQpWh/XGKZKB/D0mATrrqPDAbJn3jY9DweW4R6R+hZCi8Ln0UBa+grIgiuc/gFhS8ElVfrLWhwmeMtPRjdWNjuYe2LJ/bmKl3/SQZZa/HvHOAPf8Jqt5B5Mc1aya7HGmQgtY0e46cid/6NUZUDJW2YlGJPm7uV/p3XWz9NyRY7GiioDF1F2+0cmTWqZJep6+fu2bRDdpfG9hdLEbVb5ZJykxmpfG3H6ETdOt7ld2+DgCDz2YSiQbjT8OYu23ra8xsvaenLV08sG4M2XZ1c/BzzNAgFHhQduBhE9y,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:AoDD6kv6OLXY6zBkN6MiIw==,type:str]
+    values.yaml: ENC[AES256_GCM,data:/i/7U40uJ11Zl5/882qWzyWOI0sdzGdyvPrvImM6xULCb3t91D2sXLJK19DMnG5b2XARgN/PDmXhK/yux8OZzj3pDac8dNvgrhqL7peAuf61TWUtqmse+6V5P5ajaeVuWnbsSSrTZKg6HZY0Olzd34qsMSwmFp5FPcROSfPwxMuTqHG1OBaRzcIiIEna6rGZ8jItsqimDa0ce6nZ16t0nRFlhHVGMKZxc8Ctb56W2TRmyk8mh3VArhA/PI+tMwFKwUy00Gotywd6wvug0dgRk+EcHJrSCyDQQvTgLFzHlhbB2hZs5zRyCNc4ipvSJtMl1gG5I+rDabFIz6+4/f0wHyuCED0Tr4TMWwibbHBOy1xObS8Dk7eBMDxNykhCKriHdNgGimzyutOGfqm6EVRY6+22aHAzEkMNaaN4zfSkVIbmGl5TMsaRhdZGb1vSfkToLAJPxk9Tpjer/5DJ7dui2b0HkqJ1oAUDdpXzgm05mn7CW/LN7JwzBo2IOn1izzCK5OU4KrzqPJFz,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:HoSC13tQzd8GT1YFKQK6Lg==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGWDFqMVBkbDU5eXhyM1Nt
-            OXBnY21teUw0UDE0NVBGN2RQamFBRzVQREJrCjFUM055VHdISnVMTXU5enJiYnR2
-            bEJ6VElobVlnaDNqbElVZEorTVd6em8KLS0tIEgyKy9pbG9RVkp6UzZYMXJweG1E
-            b2lFNkovbnc3LzdLRjZZZEtGUkxhTmcKRZhddlW9oN818aGqjLh7NGIEi2F0HPPj
-            5vhPq+X+VbHJORh6Ss/lPc43j8LvTRMpinGZTnaKHS2DUs+gPQbGOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuK2xIT3M0cGtVOHdKYklF
+            OHl1VHFRTkVSaHVQNUUyRlhZUjRWM3JUN0hBCnpUS2YzdG1mSjlRaEVvTHdKVkR4
+            L1hrR05IRUdqdGp2aU95aWxRRXdsQWcKLS0tICtLbnFsK3Zza053VXFWdVErRy92
+            WUUzZTBIRzUyWnp5a1ZScUVqb0NyencKvnFyJCR6j1/aH4gJvFmLPNlk5XpC08wF
+            mTmL981uGfz4NULc+O3sDkonJ827glpefgWPgPW2HmKT88d4A9vyJw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVY0NXa1B5c2RzbzRReU1h
+            RHBSbk9aK3d6VjRWZ1hzL3FDZFZJZGFqTVQ0Ck9ib0p3bkR6cU8yc0VFNjEzSFFi
+            T3dWY1luQW1VZ1NjZFNoZFFLSCsvelkKLS0tIHIxV0d6TWhpSEc3d3c0L1VvOWxk
+            eDhTM2pDbTNXZXlWRVYxR2tPQU5iLzgKrLLLSBU/g5ebeRNi7hWYbcuJ/2JOfiUn
+            0DBnzMVJPBfqq/u8THiRYaMajx3k4D9+FN7qc5nBgTd85iGBo+OowA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-28T19:02:52Z"
-    mac: ENC[AES256_GCM,data:/UUr3ME1NZjN6nAVm7DDXBGuEM9PCFxbPXSn+gSD0PSEB6iq1YwwmKSgKA/+Y5pDa/fJvSHsdEPka+PPdCB5/cGEr+qoMqtEW/jScqw8fVCXKHM/7/OCKPJILGZyQKHaFxoBGzEZn1osJrBoILpHR0Gf6gc3XcsTnWRLD9iGDQw=,iv:ixwKglOUHad513pXZcdc1mEHNXeceN0tqkevr38iUrc=,tag:51aB11R7gndUHE7eLJQ9Yw==,type:str]
+    lastmodified: "2026-07-28T19:13:00Z"
+    mac: ENC[AES256_GCM,data:j4SdYQBtDe9TRssrUvaEk/748P+Lt1fm0r7jeWJhE17jq3WC4czLZt0djefVsdt48gJJdH5Xh3YqRy5Jh7yeFrbbfvzbvUOlsIZxW1AjqTMnSfRN7b7P3uy3FhUEMu0h5hr1DMhLUYnS8DEZESUGPXsenGYMbrIB6j0drjmdWhc=,iv:+2GpjvchggDPEiP9SWnHJhvqjWL6nqMSDoivxDC17ZY=,tag:+ZyWypwpeQXd9aiOUj5BcA==,type:str]
     version: 3.13.3