refactor: update Vault secret paths to new categorized structure

- code-server: code-server → applications/code-server
- mas: mas → applications/mas, postgresql → storage/postgresql
- umami: umami → applications/umami
- headlamp: authelia → security/authelia

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

code-server/manifests/secret.yaml

@@ -14,5 +14,5 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: code-server
+        key: applications/code-server
         property: PASSWORD

headlamp/manifests/external-secret.yaml

@@ -23,5 +23,5 @@ spec:
   data:
     - secretKey: clientSecret
       remoteRef:
-        key: authelia
+        key: security/authelia
         property: HEADLAMP_CLIENT_SECRET

mas/manifests/external-secret.yaml

@@ -13,7 +13,7 @@ spec:
   data:
   - secretKey: anthropic-api-key
     remoteRef:
-      key: mas
+      key: applications/mas
       property: ANTHROPIC_API_KEY
 ---
 apiVersion: external-secrets.io/v1
@@ -31,5 +31,5 @@ spec:
   data:
   - secretKey: password
     remoteRef:
-      key: postgresql
+      key: storage/postgresql
       property: PASSWORD

umami/manifests/secret.yaml

@@ -14,9 +14,9 @@ spec:
   data:
     - secretKey: database-url
       remoteRef:
-        key: umami
+        key: applications/umami
         property: DATABASE_URL
     - secretKey: hash-salt
       remoteRef:
-        key: umami
+        key: applications/umami
         property: HASH_SALT