fix(unifi): the installer secret was committed unencrypted

Every other *.sops.yaml in this repo carries sops metadata and ENC[] values;
this one shipped with neither and both fields as literal REPLACE-ME. Two
consequences: 'sops <file>' fails with 'sops metadata not found', so the
documented operator step could not work; and Flux would pass the file through
undecrypted and create the Secret with the literal placeholder strings.

Encrypted in place with the repo's age recipient, placeholders intact.
Round-trip verified: sops -d returns installer-url and console-password as
REPLACE-ME, so the operator's workflow is now the normal one — sops the file,
set both values, commit.

Both fields need setting, not just the password: installer-url is also
REPLACE-ME, which I had omitted from the operator instructions.

Co-Authored-By: Claude Opus 5 <[email protected]>

apps/vms/unifi/unifi-uos-installer.sops.yaml

@@ -5,8 +5,8 @@ metadata:
     namespace: unifi
 type: Opaque
 stringData:
-    installer-url: ENC[AES256_GCM,data:CwdpCy4dKbJa7A==,iv:zdKrFad7Lg2g7bM7ALLPzp/3VIjXCahZABEscpJCYF4=,tag:inlLeAKrPrt9qvr8/Y4Hiw==,type:str]
-    console-password: ENC[AES256_GCM,data:F+3lMUjA092RVg==,iv:h7NenRZUEJxTjzRDGCLBMHRtLl9h122wLvUvNGfmB50=,tag:Emo5y0qOUBptnXK03sgadQ==,type:str]
+    installer-url: ENC[AES256_GCM,data:CGCWLMiHlF57/w==,iv:/tilBVekwbHkAjSBi5UKUljfaqPo/hXhNqMYS4LY/kA=,tag:b7SeEM30ua/HvutGHYEdXg==,type:str]
+    console-password: ENC[AES256_GCM,data:gkPbmZ4g7he2WA==,iv:T9PUgAmOsrt4LUB+5vXBr9ctOPsXP5z/vMWr2ls+3ko=,tag:83HDr4kCrUF7u83fpIkm4A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -16,14 +16,14 @@ sops:
         - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMHpXYVhkblBNQWJ2NlZW
-            WXJPSDcxUEdYakN0R1Nydkc1a2E5anJSNEV3CmM1MUpiNzZUa0dKQXNRZGpTRm9l
-            UnMvMTNDL3gvUG1jVFdBbUI3aU01RkkKLS0tIGh2OUNyZzFpMXI1SWFSZENPNVVJ
-            R2V4N3plREx5UGJ2emprTS9WRzljRXMKCWIHr3+L+H2QxocHmA5oDdjZBfvo2Z5F
-            6JLNGs0M7O0X5n+IUqyM+pU+BbqHX+y2hTOSwOgCSV9Zw+ME1kUTKg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIV3hvNUVRTWxINmtaQkp5
+            a0VkYitYNHFWUGRhYncxVXl4MFdET1VmQTJZCnVXaDhaRHpQVkdHWG4xUElqRFNG
+            VUhPU3dpa0VMWGxQdUxGeDZuNFZWVm8KLS0tIEFMY2RNVDBvMG51SkhqVzlXUjRR
+            TG9kcHdSTU5QOGpnLzkyVW9hUWJLem8KW536eEsviMq5/uyg3/RT/PrEgr4PBL3E
+            yNemOTU76DdU81/neHb/6NVWT44ffLoCltgSrCQ0ieBwDAorjQ3bEg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-09-14T07:13:55Z"
-    mac: ENC[AES256_GCM,data:A2JQR++tYY9XrRmN1x24klU4xpanx0Ab64AIPGfvtHUxwtG2JLCMMAHIe64eM60FIKT5ibmnVVeuRIUoDwm5d3WpdX2gmGpzxyr9TDhEcEA2ENQGP5TydnmcmchNcu//FfXTXTgm91+WjBke06gibKEF9H+65s2YbkOtheFUjqA=,iv:tQkW7xDGMb8+35QAx+svTQDEwlvW8AQfouopeRqtNTg=,tag:fLJ58ovDbf5qy0sxBqUfPw==,type:str]
+    lastmodified: "2026-09-19T01:51:00Z"
+    mac: ENC[AES256_GCM,data:yKGOdLKnIUUeSyJuzyp4CiJFhTyIJv6S8PTEdnioCpeSoRpptWYQIKR8BUrYx1/4NnghvOEyS5o0nRT56dq7vf2G+CoRf03/alDW/YHUjkAfIRjorPCO638mjdIPDytfsTBOyBXnjzjMlhHwoDjHskk+J66Qm42xFd476w9cYig=,iv:M1SwKW2ZUehklgUP+n3fefb2XoDDPBs5HnTklVh3KwM=,tag:q6eoA+pdHnwWKxQODCN7jQ==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4