feat: wire official-bots to external tournament server

Adds the env vars and secret structure needed for the official-bots pod
to connect to the external tournament server at 141.37.123.132:8086.

- TOURNAMENT_SERVER_URL and TOURNAMENT_BOT_DIFFICULTY added as plain env
  vars to the nowchess-official-bots rollout
- TOURNAMENT_BOT_TOKEN wired from a new ncs-tournament-secret SealedSecret
- Placeholder SealedSecret files added for staging, eu-central-1-prod, and
  htwg-1-prod — must be sealed with a real bot token before deploying

TOURNAMENT_ID is intentionally omitted; it is per-tournament and supplied
at runtime via POST /api/bots/official/join-tournament.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nowchess/base/nowchess-rollouts.yaml

@@ -441,6 +441,15 @@ spec:
                   key: INTERNAL_SECRET
             - name: ACCOUNT_SERVICE_URL
               value: http://nowchess-account:8083
+            - name: TOURNAMENT_SERVER_URL
+              value: "http://141.37.123.132:8086"
+            - name: TOURNAMENT_BOT_DIFFICULTY
+              value: "medium"
+            - name: TOURNAMENT_BOT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: ncs-tournament-secret
+                  key: TOURNAMENT_BOT_TOKEN
           ports:
             - containerPort: 8088
               protocol: TCP