docs(prod): replace internal memory refs in overlay comments

Address Copilot review on #39: comments referenced Claude's internal
"memory" notes (e.g. "see memory j26_prod_dbs_platsbank_cms_scoutin2" and
the [[prod_overlay_pattern]] wikilink), which are meaningless to repo
readers and age poorly. Rewrite them to reference concrete repo facts —
the actual KV object name / prod DB, and the established j26-app / j26-auth
prod overlays as the pattern reference. Comment-only changes; rendered
output is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hakan-persson

k8s/app-manifest-prod/j26-cms/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 # Production overlay for j26-cms (Payload CMS). References the dev package as a base (left untouched)
-# and patches only what differs in prod, per [[prod_overlay_pattern]]:
+# and patches only what differs in prod, per the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; bare 0.1.0, no leading v)
 #   - SecretProviderClass: repoint PAYLOAD_SECRET → prod KV object, and ADD DATABASE_URL ← prod KV DSN

k8s/app-manifest-prod/j26-map/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 # Production overlay for j26-map (static map frontend, no secrets, no DB). References the dev
-# package as a base (left untouched) and patches only what differs in prod, per [[prod_overlay_pattern]]:
+# package as a base (left untouched) and patches only what differs in prod, per the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; NB the GHCR tag is bare 0.1.0, no leading v)
 #   - ingress: dev's nginx Ingress is removed and replaced by a Traefik IngressRoute + StripPrefix

k8s/app-manifest-prod/j26-photo-permission/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 # Production overlay for j26-photo-permission (photo-consent frontend, no secrets, no DB).
 # References the dev package as a base (left untouched) and patches only what differs in prod,
-# per [[prod_overlay_pattern]]:
+# per the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to v0.1.0 (dev base tracks :latest; NB this image's GHCR tag carries the leading
 #     `v` — like notifications, UNLIKE the bare 0.1.0 of map/screens/signupinfo)

k8s/app-manifest-prod/j26-platsbank/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 # Production overlay for j26-platsbank (Gleam-less TS service + Prisma; "platsbank"). References the
 # dev package as a base (left untouched) and patches only what differs in prod, per
-# [[prod_overlay_pattern]]:
+# the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; bare 0.1.0, no leading v)
 #   - DB: dev uses the Azure Service Connector secret sc-postgresql531ff-secret; prod DROPS Service

k8s/app-manifest-prod/j26-platsbank/secret-provider-class.yaml

@@ -1,9 +1,10 @@
 # Prod-only SecretProviderClass for j26-platsbank. The dev base has NO SPC — dev sources the DB via
 # the Azure Service Connector secret sc-postgresql531ff-secret. Prod drops Service Connector
 # entirely (it isn't needed: the app only reads DATABASE_URL) and instead pulls the full DSN string
-# straight from Key Vault via CSI — exactly the j26-notifications pattern. This SPC materializes the
-# Secret `j26-platsbank-secrets` with key DATABASE_URL from the prod KV DSN object created 2026-06-29
-# (see memory j26_prod_dbs_platsbank_cms_scoutin2). The deployment patch wires DATABASE_URL from it.
+# straight from Key Vault via CSI — the same approach as j26-notifications. This SPC materializes the
+# Secret `j26-platsbank-secrets` with key DATABASE_URL from the KV object j26-prod-platsbank-postgres-dsn
+# (the DSN for the role-owned prod database j26_prod_platsbank on psql-j26apps-shared-sdc). The
+# deployment patch wires the container's DATABASE_URL env from this Secret.
 apiVersion: secrets-store.csi.x-k8s.io/v1
 kind: SecretProviderClass
 metadata:

k8s/app-manifest-prod/j26-scoutin-2/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 # Production overlay for j26-scoutin-2 (check-in app; image is `scoutin-2`, NOT j26-scoutin-2).
 # References the dev package as a base (left untouched) and patches only what differs in prod, per
-# [[prod_overlay_pattern]]:
+# the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; bare 0.1.0, no leading v)
 #   - SecretProviderClass: 21 keys = dev 20 + DATABASE_URL. 3 app-internal secrets repointed to fresh

k8s/app-manifest-prod/j26-screens/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 # Production overlay for j26-screens (static screens-display frontend, no secrets, no DB).
 # References the dev package as a base (left untouched) and patches only what differs in prod,
-# per [[prod_overlay_pattern]]:
+# per the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; NB the GHCR tag is bare 0.1.0, no leading v)
 #   - ingress: dev's nginx Ingress is removed and replaced by a Traefik IngressRoute + StripPrefix

k8s/app-manifest-prod/j26-signupinfo/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 # Production overlay for j26-signupinfo (Scoutnet stats dashboard, FastAPI+React). No DB; secrets
 # come from Azure KV via CSI. References the dev package as a base (left untouched) and patches
-# only what differs in prod, per [[prod_overlay_pattern]]:
+# only what differs in prod, per the same prod-overlay pattern as the j26-app / j26-auth overlays:
 #   - namespace: j26-prod
 #   - image pinned to 0.1.0 (dev base tracks :latest; NB the GHCR tag is bare 0.1.0, no leading v)
 #   - ServiceMonitor: namespaceSelector restated to j26-prod (see servicemonitor-patch.yaml)