fix(myorg-assistant): add WEB_SECRET_KEY env to cronjobs to stop pydantic Settings validation crash

CronJob pods were stuck in ImagePullBackOff because they referenced
the local-only image 'myorg-assistant:latest' which is not present
on the node. Switch all 5 cronjobs to the Gitea registry image
git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
(matching the Deployment), set imagePullPolicy: Always, and add
imagePullSecrets: gitea-registry so they can authenticate to the
private registry.

argocd-bootstrap.yaml

@@ -22,3 +22,9 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=false
+  ignoreDifferences:
+    - group: argoproj.io
+      kind: Application
+      jsonPointers:
+        - /status
+        - /operation

myorg-assistant/cronjobs/deadline-checker.yaml

@@ -22,10 +22,12 @@ spec:
             job: deadline-checker
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: deadline-checker
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: IfNotPresent
+            imagePullPolicy: Always
             command:
             - python
             - run_job.py
@@ -51,6 +53,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/evening-summary.yaml

@@ -22,10 +22,12 @@ spec:
             job: evening-summary
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: evening-summary
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: IfNotPresent
+            imagePullPolicy: Always
             command:
             - python
             - run_job.py
@@ -51,6 +53,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/git-sync.yaml

@@ -22,10 +22,12 @@ spec:
             job: git-sync
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: git-sync
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: IfNotPresent
+            imagePullPolicy: Always
             command:
             - python
             - run_job.py
@@ -66,6 +68,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/morning-briefing.yaml

@@ -22,10 +22,12 @@ spec:
             job: morning-briefing
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: morning-briefing
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: IfNotPresent
+            imagePullPolicy: Always
             command:
             - python
             - run_job.py
@@ -58,6 +60,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg

myorg-assistant/cronjobs/waiting-followup.yaml

@@ -22,10 +22,12 @@ spec:
             job: waiting-followup
         spec:
           restartPolicy: OnFailure
+          imagePullSecrets:
+          - name: gitea-registry
           containers:
           - name: waiting-followup
-            image: myorg-assistant:latest
+            image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
-            imagePullPolicy: IfNotPresent
+            imagePullPolicy: Always
             command:
             - python
             - run_job.py
@@ -51,6 +53,11 @@ spec:
                 secretKeyRef:
                   name: myorg-assistant-secret
                   key: LITELLM_API_KEY
+            - name: WEB_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: myorg-assistant-secret
+                  key: WEB_SECRET_KEY
             volumeMounts:
             - name: myorg-data
               mountPath: /data/myorg