fix: Make CrowdSec bouncer optional for ingress-nginx startup

- Add optional: true to secretKeyRef so ingress pods start without
  the bouncer key (CrowdSec deploys after infrastructure)
- Move ingress bouncer SealedSecret to crowdsec app (creates in
  ingress namespace when CrowdSec deploys)
- Ingress starts without CrowdSec, bouncer activates after secret appears

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

kubernetes/apps/crowdsec/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - bouncer-secret.yaml
+  - ingress-bouncer-secret.yaml
   - helmrelease.yaml

kubernetes/infrastructure/ingress-nginx/helmrelease.yaml

@@ -61,6 +61,7 @@ spec:
                 secretKeyRef:
                   name: crowdsec-bouncer-key
                   key: key
+                  optional: true
             - name: BOUNCER_CONFIG
               value: "/crowdsec/crowdsec-bouncer.conf"
           volumeMounts:

kubernetes/infrastructure/post-crds/kustomization.yaml

@@ -3,5 +3,4 @@ kind: Kustomization
 resources:
   - clusterissuer.yaml
   - cloudflare-secret.yaml
-  - bouncer-secret.yaml
   - cilium-l2.yaml