fix: corrected ApplicationSet template, drop secret stubs from manifests

- appset: goTemplate, filename-based app names, .path.path IS the directory,
  exclude apps/root from the glob (v3.5 git files-generator schema)
- remove empty Secret stubs: with prune:true they would overwrite live
  secret values (openwebui, paperless, vaultwarden-admin-token, password)
- secrets stay cluster-managed, not in git

tools/validate_all.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Dry-run validate every app manifest in apps/default/ against live cluster
+export KUBECONFIG="C:\\Users\\ivanch\\.kube\\config"
+cd "C:/Users/ivanch/Desktop/gitops-draft" || exit 1
+fail=0
+for f in apps/default/*.yaml; do
+  out=$(kubectl.exe apply --dry-run=server -f "$f" 2>&1)
+  if echo "$out" | grep -qi "error"; then
+    echo "FAIL: $f"
+    echo "$out" | grep -i error | head -2
+    fail=1
+  else
+    echo "OK: $f"
+  fi
+done
+[ $fail -eq 0 ] && echo "ALL apps/default dry-runs clean"
+exit $fail