feat(coturn): add scoped age recipient for automated rotation job

Adds a second age recipient (dedicated keypair, private key never touches
the repo) to just these two files, so the upcoming rotation CronJob can
decrypt/re-encrypt them without needing the repo's master sops-age key,
which can decrypt every secret in the repo. Verified: master key still
decrypts both files; the new scoped key can decrypt both files but
correctly cannot decrypt an unrelated secret (authentik-secret.yaml).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/production/synapse-turn-secret.yaml

@@ -4,19 +4,28 @@ metadata:
     name: synapse-turn-secret
     namespace: matrix
 stringData:
-    values.yaml: ENC[AES256_GCM,data:fFKCOus4okAo98WwfNkbdLyBFfkp9C1znMeSHh/Og6Z/rRbivsHeKFYjW3O0rHOy9kds/mtWxE4f7ealjY+5gsslwi/Rzp56AD4O+m7OEs5wcIVQsv8UT5IkUDbrYE3LJwMrl+sqw/jmZ1BR22a2ZEYGk3r1Y5S/gDI99AiydwUiYdOueSCRQg6AEEr6LDR898J8ZVcMlaRZ+4ZkbVrIZcuKN6oxq3eqPR3kugIMjQpWh/XGKZKB/D0mATrrqPDAbJn3jY9DweW4R6R+hZCi8Ln0UBa+grIgiuc/gFhS8ElVfrLWhwmeMtPRjdWNjuYe2LJ/bmKl3/SQZZa/HvHOAPf8Jqt5B5Mc1aya7HGmQgtY0e46cid/6NUZUDJW2YlGJPm7uV/p3XWz9NyRY7GiioDF1F2+0cmTWqZJep6+fu2bRDdpfG9hdLEbVb5ZJykxmpfG3H6ETdOt7ld2+DgCDz2YSiQbjT8OYu23ra8xsvaenLV08sG4M2XZ1c/BzzNAgFHhQduBhE9y,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:AoDD6kv6OLXY6zBkN6MiIw==,type:str]
+    values.yaml: ENC[AES256_GCM,data:/i/7U40uJ11Zl5/882qWzyWOI0sdzGdyvPrvImM6xULCb3t91D2sXLJK19DMnG5b2XARgN/PDmXhK/yux8OZzj3pDac8dNvgrhqL7peAuf61TWUtqmse+6V5P5ajaeVuWnbsSSrTZKg6HZY0Olzd34qsMSwmFp5FPcROSfPwxMuTqHG1OBaRzcIiIEna6rGZ8jItsqimDa0ce6nZ16t0nRFlhHVGMKZxc8Ctb56W2TRmyk8mh3VArhA/PI+tMwFKwUy00Gotywd6wvug0dgRk+EcHJrSCyDQQvTgLFzHlhbB2hZs5zRyCNc4ipvSJtMl1gG5I+rDabFIz6+4/f0wHyuCED0Tr4TMWwibbHBOy1xObS8Dk7eBMDxNykhCKriHdNgGimzyutOGfqm6EVRY6+22aHAzEkMNaaN4zfSkVIbmGl5TMsaRhdZGb1vSfkToLAJPxk9Tpjer/5DJ7dui2b0HkqJ1oAUDdpXzgm05mn7CW/LN7JwzBo2IOn1izzCK5OU4KrzqPJFz,iv:+DYUBkJC8FZIl+mXc5NWv1EfSRWq+ho1huwTerFhZwM=,tag:HoSC13tQzd8GT1YFKQK6Lg==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGWDFqMVBkbDU5eXhyM1Nt
-            OXBnY21teUw0UDE0NVBGN2RQamFBRzVQREJrCjFUM055VHdISnVMTXU5enJiYnR2
-            bEJ6VElobVlnaDNqbElVZEorTVd6em8KLS0tIEgyKy9pbG9RVkp6UzZYMXJweG1E
-            b2lFNkovbnc3LzdLRjZZZEtGUkxhTmcKRZhddlW9oN818aGqjLh7NGIEi2F0HPPj
-            5vhPq+X+VbHJORh6Ss/lPc43j8LvTRMpinGZTnaKHS2DUs+gPQbGOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuK2xIT3M0cGtVOHdKYklF
+            OHl1VHFRTkVSaHVQNUUyRlhZUjRWM3JUN0hBCnpUS2YzdG1mSjlRaEVvTHdKVkR4
+            L1hrR05IRUdqdGp2aU95aWxRRXdsQWcKLS0tICtLbnFsK3Zza053VXFWdVErRy92
+            WUUzZTBIRzUyWnp5a1ZScUVqb0NyencKvnFyJCR6j1/aH4gJvFmLPNlk5XpC08wF
+            mTmL981uGfz4NULc+O3sDkonJ827glpefgWPgPW2HmKT88d4A9vyJw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVY0NXa1B5c2RzbzRReU1h
+            RHBSbk9aK3d6VjRWZ1hzL3FDZFZJZGFqTVQ0Ck9ib0p3bkR6cU8yc0VFNjEzSFFi
+            T3dWY1luQW1VZ1NjZFNoZFFLSCsvelkKLS0tIHIxV0d6TWhpSEc3d3c0L1VvOWxk
+            eDhTM2pDbTNXZXlWRVYxR2tPQU5iLzgKrLLLSBU/g5ebeRNi7hWYbcuJ/2JOfiUn
+            0DBnzMVJPBfqq/u8THiRYaMajx3k4D9+FN7qc5nBgTd85iGBo+OowA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1x4jjwc8nuttwr8us924pvdc6dll5npkc6c8f4zf2hx5d2qu75dtqx0fm0d
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-28T19:02:52Z"
-    mac: ENC[AES256_GCM,data:/UUr3ME1NZjN6nAVm7DDXBGuEM9PCFxbPXSn+gSD0PSEB6iq1YwwmKSgKA/+Y5pDa/fJvSHsdEPka+PPdCB5/cGEr+qoMqtEW/jScqw8fVCXKHM/7/OCKPJILGZyQKHaFxoBGzEZn1osJrBoILpHR0Gf6gc3XcsTnWRLD9iGDQw=,iv:ixwKglOUHad513pXZcdc1mEHNXeceN0tqkevr38iUrc=,tag:51aB11R7gndUHE7eLJQ9Yw==,type:str]
+    lastmodified: "2026-07-28T19:13:00Z"
+    mac: ENC[AES256_GCM,data:j4SdYQBtDe9TRssrUvaEk/748P+Lt1fm0r7jeWJhE17jq3WC4czLZt0djefVsdt48gJJdH5Xh3YqRy5Jh7yeFrbbfvzbvUOlsIZxW1AjqTMnSfRN7b7P3uy3FhUEMu0h5hr1DMhLUYnS8DEZESUGPXsenGYMbrIB6j0drjmdWhc=,iv:+2GpjvchggDPEiP9SWnHJhvqjWL6nqMSDoivxDC17ZY=,tag:+ZyWypwpeQXd9aiOUj5BcA==,type:str]
     version: 3.13.3