feat: wire official-bots to external tournament server

Adds the env vars and secret structure needed for the official-bots pod
to connect to the external tournament server at 141.37.123.132:8086.

- TOURNAMENT_SERVER_URL and TOURNAMENT_BOT_DIFFICULTY added as plain env
  vars to the nowchess-official-bots rollout
- TOURNAMENT_BOT_TOKEN wired from a new ncs-tournament-secret SealedSecret
- Placeholder SealedSecret files added for staging, eu-central-1-prod, and
  htwg-1-prod — must be sealed with a real bot token before deploying

TOURNAMENT_ID is intentionally omitted; it is per-tournament and supplied
at runtime via POST /api/bots/official/join-tournament.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

secrets/kustomization.yaml

@@ -11,10 +11,12 @@ resources:
   - nowchess/staging/ncs-jwt-keys.yaml
   - nowchess/staging/ncs-db-secrets.yaml
   - nowchess/staging/ncs-internal-secret.yaml
+  - nowchess/staging/ncs-tournament-secret.yaml
   - nowchess/eu-central-1-prod/ghcr-pull-secret.yaml
   - nowchess/eu-central-1-prod/ncs-jwt-keys.yaml
   - nowchess/eu-central-1-prod/ncs-db-secrets.yaml
   - nowchess/eu-central-1-prod/ncs-internal-secret.yaml
+  - nowchess/eu-central-1-prod/ncs-tournament-secret.yaml
   - nowchess/kargo/ghcr-image-secret.yaml
   - nowchess/kargo/github-image-secret.yaml
   - nowchess/kargo/remotek6-certs.yaml

secrets/nowchess/eu-central-1-prod/ncs-tournament-secret.yaml

@@ -0,0 +1,16 @@
+# PLACEHOLDER — seal with eu-central-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-tournament-secret \
+#     --from-literal=TOURNAMENT_BOT_TOKEN=<token-from-nowchess-api> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-tournament-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-tournament-secret
+      namespace: nowchess

secrets/nowchess/htwg-1-prod/ncs-tournament-secret.yaml

@@ -0,0 +1,16 @@
+# PLACEHOLDER — seal with htwg-1 cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-tournament-secret \
+#     --from-literal=TOURNAMENT_BOT_TOKEN=<token-from-nowchess-api> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-tournament-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-tournament-secret
+      namespace: nowchess

secrets/nowchess/staging/ncs-tournament-secret.yaml

@@ -0,0 +1,16 @@
+# PLACEHOLDER — seal with staging cluster key before use:
+#   kubectl -n nowchess create secret generic ncs-tournament-secret \
+#     --from-literal=TOURNAMENT_BOT_TOKEN=<token-from-nowchess-api> \
+#     --dry-run=client -o yaml | kubeseal --controller-namespace kube-system -o yaml > this-file.yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ncs-tournament-secret
+  namespace: nowchess
+spec:
+  encryptedData:
+    REPLACE_KEY: REPLACE_WITH_SEALED_VALUE
+  template:
+    metadata:
+      name: ncs-tournament-secret
+      namespace: nowchess