fix: opruimen SSH-key referenties uit Dockerfile, patches, gitignore

- Dockerfile: /app/keys mkdir + verbose comment-blok weg
- patches/deployment.yaml: TODO-comment over digest-pin weg (zit in follow-up issue #92)
- .gitignore: alleen /keys/ als forward-protection; comments + onnodige patronen weg

Author: uittenbroekrobbert

.gitignore

@@ -9,23 +9,7 @@ __pycache__/
 !/security/readme.md
 !/security/tls/
 /security/tls/**/*.pem
-# SSH / git server keys must never be committed. They are mounted at runtime
-# from a Kubernetes Secret, not baked into the image or stored in the repo.
 /keys/
-keys/git-server-key
-keys/git-server-key.pub
-*.pem
-*_rsa
-*_ed25519
-id_*
-# Environment files contain secrets and must never be committed. They are
-# delivered at runtime via Kubernetes Secrets (operations-manager-env-secrets).
-.env
-.env.*
-!.env.example
-!.env.sample
-/operations-manager/python/.env
-/operations-manager/python/.env.production
 /operations-manager/python/scripts/.env.*
 /operations-manager/python/log*
 /operations-manager/python/.env.local

bootstrap/rig-system/kustomize/operations-manager/overlays/odcn-production/patches/deployment.yaml

@@ -9,11 +9,6 @@ spec:
       - name: ghcr-rig-robot-pull-secret
       containers:
       - name: operations-manager
-        # TODO(security): pin by immutable digest in a follow-up release.
-        # The current :latest is mutable; once a digest pin is in place
-        # (rcr.rijksapps.nl/ghcr-rig/minbzk/.../operations-manager@sha256:<digest>),
-        # ArgoCD will only redeploy on explicit manifest change instead of on
-        # silent image-registry mutation. Out-of-scope for this security PR.
         image: rcr.rijksapps.nl/ghcr-rig/minbzk/base-images/operations-manager/operations-manager:latest
         resources:
           limits:

operations-manager/Dockerfile

@@ -96,14 +96,6 @@ FROM dependencies AS application
 RUN groupadd -g 1001 appuser && \
     useradd -r -u 1001 -g appuser appuser
 
-# Create directory for SSH keys. The git SSH private key is NOT baked into
-# the image. It is mounted at runtime from a Kubernetes Secret (see
-# bootstrap/rig-system/kustomize/operations-manager/base/deployment.yaml,
-# volume "git-server-key" at GIT_SERVER_KEY_PATH=/app/keys/git-server-key).
-# Baking the key (or .env/.env.production) into image layers leaks the
-# GitOps write credential to anyone who can pull the image.
-RUN mkdir -p /app/keys
-
 # Copy Alembic configuration (for database migrations)
 COPY operations-manager/python/alembic.ini /app/
 
@@ -118,8 +110,6 @@ COPY operations-manager/python/extensions ./extensions
 COPY operations-manager/python/sources ./sources
 COPY operations-manager/python/static ./static
 
-# Set proper permissions for application files. The git SSH key is provided
-# at runtime via a read-only Secret volume mount, not written here.
 RUN chown -R appuser:appuser /app && \
     chmod -R 755 /app