fix(trmnl): drop the timestamp overlay, the dashboard has a clock card

The dashboard now carries a type: clock card, which the browser draws
at capture time — so the time in the image is already the time the
screenshot was taken, and the renderer's overlay would print it twice.

Supersedes the overlay added a commit ago, which was itself replacing a
Home Assistant template sensor that fired a state-changed event and
wrote a recorder row every minute. The card does the same job with no
entity, no event and no row.

Pairs with homeassistant#221.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

kubernetes/apps/trmnl/renderer.yaml

@@ -29,6 +29,19 @@ data:
   # The app re-reads schedules.json every 60 s, so edits here take
   # effect without a restart once the init container has rewritten it.
   #
+  # timestamp stays false: the dashboard carries a clock CARD, which
+  # the browser draws at capture time — so the time in the image is
+  # already the time the screenshot was taken, and the renderer's own
+  # overlay would just print it twice.
+  #
+  # lang is "de", not null. It calls Home Assistant's own
+  # _selectLanguage() for the screenshot session, so the rendered page
+  # is localised by HA rather than by hand. With it left null the
+  # dashboard grew a German weekday array, a German month array and a
+  # fifteen-entry weather-condition dict — reimplementing translations
+  # HA already ships. The instance itself stays language "en"; this
+  # only affects the render session.
+  #
   # model_id is 1 — TRMNL X (name "v2", 1872x1404, 16 colours) — and it
   # is an INTEGER, not a name. Confirmed against the running server:
   # GET /api/screens returns model_id as a number, and upstream's
@@ -61,7 +74,7 @@ data:
         "zoom": 1,
         "wait": null,
         "theme": "Graphite E-ink Light",
-        "lang": null,
+        "lang": "de",
         "dark": false,
         "invert": false,
         "timestamp": false,
@@ -107,6 +120,27 @@ metadata:
   namespace: trmnl
   labels:
     app.kubernetes.io/name: trmnl-renderer
+  annotations:
+    # BOTH sources need this, and for the same reason: the init
+    # container writes /data/schedules.json ONCE, at pod start. Nothing
+    # re-reads either source afterwards.
+    #
+    # The app re-reads schedules.json every 60s, which makes it look
+    # self-updating — but only the FILE, and the file is only rewritten
+    # by the init container. So a ConfigMap or Secret change lands in
+    # git, updates the object, and the running renderer keeps the old
+    # values indefinitely.
+    #
+    # Both halves were hit repeatedly in practice and each time needed
+    # `kubectl delete pod` by hand: the theme name, the schedule's lang
+    # field, and every re-mint of the BYOS tokens. A fix that depends on
+    # someone remembering to restart a pod is not deployed.
+    #
+    # Named per-resource rather than the blanket
+    # reloader.stakater.com/auto: "true", matching terminus.yaml and
+    # mosquitto-deployment.yaml.
+    configmap.reloader.stakater.com/reload: trmnl-renderer-schedule
+    secret.reloader.stakater.com/reload: trmnl-renderer-secrets
 spec:
   replicas: 1
   # RWO PVC, and two renderers would push conflicting screens for the

kubernetes/apps/trmnl/terminus.yaml

@@ -53,6 +53,29 @@ data:
   # NOTE: the period is fixed at mint time. Changing this does not extend
   # tokens that already exist — they must be re-minted afterwards.
   API_ACCESS_TOKEN_PERIOD: "315360000"
+  # The OTHER half of the same problem, and the reason the first fix
+  # did not hold. Terminus has TWO independent expiries: the JWT's own
+  # lifetime (above) and the SESSION behind it. Raising only the token
+  # period left the session at its defaults, so pushes kept working for
+  # a while and then failed with
+  #   HTTP 401 {"error":"This session has expired, please login again"}
+  # which is a different error, from a different mechanism, than the
+  # "expired JWT access token" the first fix addressed.
+  #
+  # Documented in doc/configuration.adoc:
+  #   SESSION_EXPIRATION_ENABLED — "Determines if your browser session
+  #   or JWT API token is expired or not." Default: true.
+  #   SESSION_INACTIVITY_LIMIT 1800s, SESSION_LIFETIME_LIMIT 86400s.
+  #
+  # Disabling it is exactly the state the renderer's own code assumes
+  # ("stock Terminus disables session expiration and issues ~100-year
+  # tokens") — an assumption that is false by default and has to be
+  # made true here, same as the token period.
+  #
+  # Same trade as above, and it is the deciding one for an unattended
+  # appliance: a session that expires needs a human with a password to
+  # restore it, and this panel has neither.
+  SESSION_EXPIRATION_ENABLED: "false"
 ---
 apiVersion: apps/v1
 kind: Deployment