fix: corrected ApplicationSet template, drop secret stubs from manifests

- appset: goTemplate, filename-based app names, .path.path IS the directory,
  exclude apps/root from the glob (v3.5 git files-generator schema)
- remove empty Secret stubs: with prune:true they would overwrite live
  secret values (openwebui, paperless, vaultwarden-admin-token, password)
- secrets stay cluster-managed, not in git

apps/default/sonic.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonic
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonic
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: sonic
+    spec:
+      containers:
+      - env:
+        - name: SEARCH_BACKEND_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: password
+        image: archivebox/sonic:latest
+        imagePullPolicy: Always
+        name: sonic
+        ports:
+        - containerPort: 1491
+          protocol: TCP
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+status:
+  availableReplicas: 1
+  conditions:
+  - lastTransitionTime: '2026-05-19T01:51:47Z'
+    lastUpdateTime: '2026-07-22T10:15:06Z'
+    message: ReplicaSet "sonic-b89458d6c" has successfully progressed.
+    reason: NewReplicaSetAvailable
+    status: 'True'
+    type: Progressing
+  - lastTransitionTime: '2026-08-28T06:04:13Z'
+    lastUpdateTime: '2026-08-28T06:04:13Z'
+    message: Deployment has minimum availability.
+    reason: MinimumReplicasAvailable
+    status: 'True'
+    type: Available
+  observedGeneration: 93
+  readyReplicas: 1
+  replicas: 1
+  terminatingReplicas: 0
+  updatedReplicas: 1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sonic-svc
+  namespace: default
+spec:
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - port: 1491
+    protocol: TCP
+    targetPort: 1491
+  selector:
+    app: sonic
+  sessionAffinity: None
+  type: ClusterIP
+status:
+  loadBalancer: {}