refactor: move GitHub secret injection to infra

Secret injection for deployed environments is environment-specific — the
secret store, GCP project, and secret names differ per stack — so it now
lives in the infra deploy overlay as an ExternalSecret plus an envFrom
Deployment patch. The external-secrets component here was never composed
into base and is now redundant.

Key changes:
- Delete config/components/external-secrets (ExternalSecret, envFrom
  patch, kustomization); the infra overlay owns this env-specific wiring
- Update the base app-config GitHub App guidance to point at the infra
  overlay for credential injection
- Drop the external-secrets rows from config/README.md and note that
  secret injection lives on the deploy side

Claude-Session: https://claude.ai/code/session_01NMSkwUcaTmZr7S5XmV2aFG

Author: scotwells

app-config.yaml

@@ -65,10 +65,11 @@ integrations:
       token: ${GITHUB_TOKEN}
       # Deployed environments authenticate as a GitHub App instead of a PAT
       # (org-wide install, higher rate limits, no personal token to rotate).
-      # The credentials are already projected into the pod by the
-      # external-secrets component (backstage-github-app -> GITHUB_APP_*).
-      # Catalog discovery polls GitHub outbound on a schedule, so no inbound
-      # webhook (and no webhookSecret) is required — see catalog.providers below.
+      # The environment's infra overlay projects the credentials into the pod
+      # (an ExternalSecret + envFrom -> GITHUB_APP_*); this repo does not own
+      # that env-specific secret wiring. Catalog discovery polls GitHub
+      # outbound on a schedule, so no inbound webhook (and no webhookSecret) is
+      # required — see catalog.providers below.
       # Enable per-environment by supplying this block from the deploy overlay:
       # apps:
       #   - appId: ${GITHUB_APP_ID}

config/README.md

@@ -10,7 +10,6 @@ config/
     database-cnpg/          # CloudNativePG Cluster + POSTGRES_* env wiring
     app-config/             # mounts a `backstage-app-config` ConfigMap as --config
     networking/             # HTTPRoute onto the shared internal-auth-gateway
-    external-secrets/       # GitHub App + backend secret from gcp-secret-store
   overlays/
     e2e/                    # base + database-cnpg + app-config, image backstage:e2e
 ```
@@ -31,10 +30,14 @@ Each component factors out one concern so any overlay can opt in via
 | `database-cnpg` | A `postgresql.cnpg.io` `Cluster` (`backstage-postgres`) and a Deployment patch sourcing `POSTGRES_*` from the generated `backstage-postgres-app` secret. Used by the kind e2e environment. |
 | `app-config` | Deployment patch that layers `app-config.yaml` with a `backstage-app-config` ConfigMap mounted at `/etc/backstage`. The overlay supplies the ConfigMap contents. |
 | `networking` | An `HTTPRoute` attaching to the shared `internal-auth-gateway` (OIDC is enforced at the gateway). |
-| `external-secrets` | An `ExternalSecret` projecting the GitHub App credentials and backend secret from the `gcp-secret-store` ClusterSecretStore into the pod. |
 
 ## overlays
 
 `e2e` composes `base` with `database-cnpg` and `app-config` and is what the
 `E2E` workflow deploys into a kind cluster. Production overlays are composed
 on the deploy side (infra repo) from `base` plus the relevant components.
+
+Secret injection (the GitHub App credentials, backend secret, etc.) is
+environment-specific — the secret store, GCP project, and secret names differ
+per stack — so it is defined in the infra overlay as an `ExternalSecret` plus
+an `envFrom` Deployment patch, not shipped as a component here.