chore: import upstream snapshot with attribution

helm/sim/templates/secrets-app.yaml

@@ -0,0 +1,51 @@
+{{- if and .Values.app.enabled (include "sim.createAppSecrets" .) }}
+{{/*
+Secret for app + realtime env. Every key in .Values.app.env and
+.Values.realtime.env is written here and mounted via envFrom on the
+respective Deployments. Chart-computed values (DATABASE_URL,
+SOCKET_SERVER_URL, OLLAMA_URL, PII_URL) are omitted — they're injected as
+inline env on the container so they reflect chart-time resolution.
+
+Treating all env values as secret-grade avoids maintaining a sensitivity
+classifier and prevents accidental leaks when new provider keys are added.
+*/}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "sim.fullname" . }}-app-secrets
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "sim.app.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- $chartComputed := list "DATABASE_URL" "SOCKET_SERVER_URL" "OLLAMA_URL" "PII_URL" }}
+  {{- /*
+    Intent: app.env is authoritative for shared keys (both pods envFrom this
+    Secret, so the app container must not be silently overwritten by a
+    realtime-side value), BUT empty strings must never win.
+
+    Sprig `merge` treats "" as a real value, so a default-empty app.env entry
+    would shadow a non-empty realtime.env entry. Build the effective dict
+    manually: start from realtime.env, then overlay non-empty app.env values
+    on top — this gives app.env-wins-on-collision without empty-string
+    shadowing. Mirrors the pattern used in deployment-realtime.yaml.
+  */}}
+  {{- $appEnv := .Values.app.env | default dict }}
+  {{- $rtEnv := .Values.realtime.env | default dict }}
+  {{- $effective := dict }}
+  {{- range $key, $value := $rtEnv }}
+  {{- if and (ne (toString $value) "") (ne (toString $value) "<nil>") }}
+  {{- $_ := set $effective $key $value }}
+  {{- end }}
+  {{- end }}
+  {{- range $key, $value := $appEnv }}
+  {{- if and (ne (toString $value) "") (ne (toString $value) "<nil>") }}
+  {{- $_ := set $effective $key $value }}
+  {{- end }}
+  {{- end }}
+  {{- range $key, $value := $effective }}
+  {{- if not (has $key $chartComputed) }}
+  {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  {{- end }}
+{{- end }}