docs(secrets): complete secrets management guide with new-service setup procedure

[andrest50]

Summary

This PR completes the LFX V2 secrets management documentation in two ways:

1. lfx_one/secrets-management.md — fills in the Step 6 TODO placeholder and restructures the full step-by-step procedure into 12 clear, ordered steps
2. lfx_one/skills/lfx-v2-secrets/SKILL.md — adds a new AI skill providing complete secrets setup guidance for Claude Code

What changed in secrets-management.md

Step reordering — Infrastructure setup now comes first (Steps 1–7), so the one-time wiring is done before adding any secrets. Per-secret work follows as Steps 8–12. A prominent callout at the top lets existing services skip directly to Step 8.

Steps	Phase	What it covers
1	One-time setup	Register IAM service account role (lfx-v2-opentofu)
2	One-time setup	Add serviceaccount.yaml Helm template
3	One-time setup	Add secretstore.yaml Helm template
4	One-time setup	Add externalsecret.yaml — tag-discovery (recommended) and explicit-data patterns
5	One-time setup	Add values.yaml defaults and document the three ESO render gates
6	One-time setup	Configure per-environment ArgoCD values with IRSA role ARNs
7	One-time setup	Configure local development (ESO disabled, manual K8s Secret)
8–12	Per secret	Add to 1Password → YAML config → PR → deploy → consume in K8s

Tag format updated throughout from the legacy service: pcc to service-pcc: enabled. This convention allows a single secret to carry tags for multiple consuming services simultaneously. Updated in: mermaid diagram, Service Tag Integration section, Configuration Example, Configuration Breakdown.

Other fixes: outdated role name examples (k8s-secret-access-pcc → lfx-v2-pcc), mermaid ExternalSecret filter labels, ArgoCD casing in prose, clarified default values wording for serviceAccount.create.

What the lfx-v2-secrets skill covers

The AI skill provides end-to-end guidance in two modes:

• Mode 1 (new service): Full walkthrough across lfx-v2-opentofu, service Helm chart, and lfx-v2-argocd — IRSA role, ServiceAccount/SecretStore/ExternalSecret templates, values defaults, per-env ArgoCD values, local dev config, and lfx-secrets-management YAML
• Mode 2 (existing service): Minimal steps to add a new secret to an already-wired service

All YAML examples are grounded in the real lfx-v2-email-service and lfx-v2-invite-service implementations and match the lfx-secrets-management schema (environments:, json_fields:, service-*: enabled tags, accounts mapping, regions as list).

Ticket

N/A

🤖 Generated with Claude Code