authentik: migrate to envFrom with per-container InfisicalSecrets

Server and worker share one Secret since their env is byte-identical. Database and SMTP values are Infisical references rather than copies.

applications/authentik/worker/authentik-worker-deployment.yaml

@@ -22,62 +22,9 @@ spec:
           image: ghcr.io/goauthentik/server:2026.5.2
           command: ["ak"]
           args: ["worker"]
-          env:
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_host
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_EMAIL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_host
-            - name: AUTHENTIK_EMAIL__PORT
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_port
-            - name: AUTHENTIK_EMAIL__USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_username
-            - name: AUTHENTIK_EMAIL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_password
-            - name: AUTHENTIK_EMAIL__FROM
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_from
-            - name: AUTHENTIK_EMAIL__USE_TLS
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_use_tls
+          envFrom:
+            - secretRef:
+                name: authentik-app-secrets
           volumeMounts:
             - name: data
               mountPath: /data