Sync the self-hosting stack

kubernetes/01-secret.example.yaml

@@ -11,13 +11,13 @@
 # entirely. Do not do both: `04-api.yaml` reads this Secret last on purpose, so a value typed here
 # wins over a generated one, and the two quietly disagreeing is the shape of the accident.
 #
-# `apps/api/init-secrets.cjs` is the Compose generator, and it must NEVER become an initContainer
+# `jarvis init-secrets` is the Compose generator, and it must NEVER become an initContainer
 # here. Its guarantee that a key is minted exactly once is every writer sharing one filesystem.
 # Per-pod, on an `emptyDir`, each replica generates its own — and the consequence is not a crash.
 # Pod A seals a vault credential under a key pod B does not have; pod B reports that credential as
 # corrupt; both pods log nothing at boot, because from each one's point of view everything is fine.
 # By the time anybody notices, there are several keys in circulation and no way to tell which
-# entries belong to which. `apps/api/mint-k8s-secret.cjs` is the same one-shot done correctly, with
+# entries belong to which. `jarvis mint-k8s-secret` is the same one-shot done correctly, with
 # the API server's 409 standing in for the filesystem's exclusion.
 #
 # Either way, keep the output. The vault key in particular is the thing every stored credential is
@@ -71,7 +71,7 @@ stringData:
   VAULT_KEY_CREATED_AT: "REPLACE_ME"
 
   # `connection_limit` is not optional here, and it is the reason this URL is in the Secret rather
-  # than assembled from parts. Prisma's default pool is per-process: N pods times that default will
+  # than assembled from parts. The api's pool is per-process: N pods times its default will
   # exhaust `max_connections` long before the application is under any real load. Size it as
   # (max_connections − reserve) ÷ (replicas + maxSurge + jobs).
   DATABASE_URL: "postgresql://jarvis:REPLACE_ME@postgres.jarvis.svc.cluster.local:5432/jarvis?schema=public&connection_limit=10&pool_timeout=20"