Pin VPS MinIO root credentials to a real Secret, fix regeneration bug

rootUser/rootPassword were left unset, relying on the chart's
auto-generation - but ArgoCD renders Helm via 'helm template', which
doesn't support the lookup() function charts use to preserve an existing
generated secret across upgrades. With selfHeal: true, every single sync
generated a BRAND NEW random root password, immediately invalidating
whatever credentials were stored in the home cluster's Vault for the
backup/CronJob consumers (vault-raft-snapshot, 3x CNPG barmanObjectStore,
nextcloud-pvc-sync) - confirmed live: all of them failing with 'Access
Key Id does not exist' right after being fixed, because the password had
already rotated out from under them again.

Fixed by pointing at a pre-existing Secret created directly on the VPS
cluster (kubectl, not git - this cluster has no Vault/ESO of its own).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/vps-standby/minio/values.yaml

@@ -2,14 +2,28 @@
 # Standalone mode: single node, single VPS disk, no erasure coding needed here -
 # this is a backup *copy*, not itself something requiring HA.
 #
-# rootUser/rootPassword are intentionally left unset: the chart auto-generates
+# Root credentials come from a pre-existing Secret created manually on the
-# a random root password and stores it in a Secret (minio/minio chart default
+# VPS cluster (kubectl, not git - matches how other VPS bootstrap secrets
-# behavior) rather than committing credentials to git. Retrieve after first
+# are handled, since this cluster has no Vault/ESO of its own to source an
-# deploy with:
+# ExternalSecret from):
-#   kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d
+#   kubectl -n minio create secret generic vps-minio-root-secret \
-
+#     --from-literal=rootUser=<user> --from-literal=rootPassword=<password>
+#
+# Originally left rootUser/rootPassword unset entirely, relying on the
+# chart's auto-generation - broke in a way that took a while to trace:
+# ArgoCD renders Helm charts via `helm template`, which does NOT support
+# the `lookup` function charts normally use to preserve an existing
+# auto-generated secret across upgrades (that only works with real `helm
+# upgrade`). Every ArgoCD sync (selfHeal: true, so this means constantly)
+# re-rendered a BRAND NEW random root password, immediately invalidating
+# whatever credentials were stored in the home cluster's Vault for the
+# backup/CronJob consumers (vault-raft-snapshot, CNPG barmanObjectStore
+# x3, nextcloud-pvc-sync) - confirmed live 2026-08-18, all of them failing
+# with "Access Key Id does not exist" despite having just been fixed.
 mode: standalone
 
+existingSecret: vps-minio-root-secret
+
 persistence:
   enabled: true
   storageClass: local-path