refactor: update Vault secret paths to new categorized structure

- alertmanager: alertmanager → observability/alertmanager
- grafana: postgresql → storage/postgresql
- prometheus: postgresql → storage/postgresql, minio → storage/minio
- thanos: minio → storage/minio

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

alertmanager/manifests/secret.yaml

@@ -14,7 +14,7 @@ spec:
   data:
     - secretKey: smtp_auth_password
       remoteRef:
-        key: alertmanager
+        key: observability/alertmanager
         property: SMTP_PASSWORD
 ---
 apiVersion: external-secrets.io/v1
@@ -81,5 +81,5 @@ spec:
   data:
     - secretKey: smtp_password
       remoteRef:
-        key: alertmanager
+        key: observability/alertmanager
         property: SMTP_PASSWORD

grafana/manifests/secret.yaml

@@ -14,5 +14,5 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: postgresql
+        key: storage/postgresql
         property: PASSWORD

prometheus/manifests/secret.yaml

@@ -14,7 +14,7 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: postgresql
+        key: storage/postgresql
         property: PASSWORD
 ---
 apiVersion: external-secrets.io/v1
@@ -43,14 +43,14 @@ spec:
   data:
     - secretKey: access_key
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_USER
         conversionStrategy: Default
         decodingStrategy: None
         metadataPolicy: None
     - secretKey: secret_key
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_PASSWORD
         conversionStrategy: Default
         decodingStrategy: None

thanos/manifests/secret.yaml

@@ -24,9 +24,9 @@ spec:
   data:
     - secretKey: access_key
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_USER
     - secretKey: secret_key
       remoteRef:
-        key: minio
+        key: storage/minio
         property: ROOT_PASSWORD