feat(coturn): add scoped age recipient for automated rotation job

Adds a second age recipient (dedicated keypair, private key never touches
the repo) to just these two files, so the upcoming rotation CronJob can
decrypt/re-encrypt them without needing the repo's master sops-age key,
which can decrypt every secret in the repo. Verified: master key still
decrypts both files; the new scoped key can decrypt both files but
correctly cannot decrypt an unrelated secret (authentik-secret.yaml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/production/coturn-secret.yaml

@@ -4,19 +4,28 @@ metadata:
     name: coturn-secret
     namespace: matrix
 stringData:
-    TURN_SECRET: ENC[AES256_GCM,data:XTkWEymgB8wz7yoXMXFkmwoTlQuW4dc7Z34UnONvKB5Qi+Wa3yVdACnFrnvE1HnzWYJ23YO+ssCNXRiixl9YVg==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:KKMuQm41ZuvvjTzGpScbIA==,type:str]
+    TURN_SECRET: ENC[AES256_GCM,data:ZLp9/NqMZ+nrU8hUdwKndBjBh6Qa94O3UUuT71E8XDt5mP6+uZeVab27IqssqNJ6+T9tuj5uw5Q9Pj3NK6rERw==,iv:t4nvWH4rqWDHDzYOrrESwwtqMQ6YJ2CQzVbcyaYiaYM=,tag:5/LDvbVVj+a5TLjLBci1Dw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRk1mK3NWc1l4T0JCOFpF
-            S0RuQ3ViZmo3QTNVL2JvZ0hzMy91R2l0TEhzCk01a1VGdk1sdVg4aWswTzRibXI4
-            ZlJtNFF5MjBONEZOaWVpeU5taHl2bkEKLS0tIGxpUHY3NUFLWFBaWm1QSlZiVFkx
-            MEJleHFnd3oyT3VPL2dsYkpMUlRkOWMKcKUIgsQ/ff49pGGXMnYwJmwqPVC7woAR
-            IEzvhcNX97xx746SnrxZe5t2YadsYMkYIl0nvqBPJhSlvqMNafpQbQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQMncxOEhRZC9jcHpjT3dW
+            Q1RNaW5pc00zVnJhWHRnZHd3TGhURWNZU2dJCk85bXJkbTEyd1ZybjhDT05pL2c3
+            ZU9EUSt1eDlSQWJyVGtsak1oS3FSR2sKLS0tIEFUdXVHL0V1ZW5VMVVBZEJaYUIw
+            U1BrYlJyQVZkZFhBdmdwbDMyK3lTQkkKEaSy1o+IICf2uaT6olapRJa/duXxjOBg
+            OqRS9axnJ71XxEnHjLTsCbkI5b+8Fux08qKaH9sMsJrWOiSHDdTXXQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQk82eGdWRmdRNFJQR0xF
+            SWhNRUtNWThZNFM0aXU3V0N4UkhtTy9NTFdnCi9pa3dsVXRja1dTL1pZTnoxQ0JT
+            UUIxekZnVGUvdFgyblFiS0JLMjU3L2cKLS0tIE1IRTJ0M3kvMFZPWVVDYjJlVkk0
+            eGJQOTVUc1NsNE5GdmJtODlmdHp3c2cKHTP6YRMTdYE/iBuSZs/Tjt4TwKCxHEIu
+            f3jTblKIqWwRHKCgOIkC16QDbpMBlNLH3JknJEdIjkB2HIrXrw1MNA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-28T19:02:42Z"
-    mac: ENC[AES256_GCM,data:1NO8bBG47PDK5zGBYVvfUHjbLct9DP3eBDurtd7ChGFiQBPRUrlLric2cfUuB54+Z1x+VV2WIEpVt6gARNcG6+gc6H+ZKZZL1PRj3Pl3NYhgbjs05R/cHYAg3QimmnuvQlM8MvZGimB48l6mkvIN+ncmoB6l/6AXG1XfmwFW87o=,iv:AABJu2TglH2nB8PMV7ORpQ0EyzznrwmgpWImvm9mB6o=,tag:md5aQyK72iL+P28y/YDqLQ==,type:str]
+    lastmodified: "2026-07-28T19:13:00Z"
+    mac: ENC[AES256_GCM,data:i2dEOiO1K1RNoGgkJyZf7eGix0yaqSwbeE1NOQf72alyA8bM8p5ufz6X2P49OUmw2d8vjsJ40sTTSUcnI2/ZoeFJ24jEN7N6pVj2Wy9DkBynIlnPWvVxa347T6/yToPp3neLreH1ap+I50FUcnK50hS+TpRHtSW+9Js5oxrJxTQ=,iv:yFmrcDr2gW1EJRNSSQ8Ie3PXS4bNFqiK5Bbvy6IGlHE=,tag:G1vn8StyJFpl+duZHb0vPg==,type:str]
     version: 3.12.2