[Phase 0] flux: add postBuild.substituteFrom for grafana-admin secret

Adds postBuild.substituteFrom to the Flux Kustomization reference manifest
so that ${GRAFANA_ADMIN_PASSWORD} in flux/monitoring/helmrelease.yaml is
substituted from the grafana-admin secret at reconcile time.

Without this block Flux passes the literal string to the Helm chart, causing
Grafana to start with a broken admin password.

The live copy in 0xWheatyz/Talos at
testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml
must also be updated with the same block (companion to issue #90).

Closes leeworks-agents/api-company#97

.gitea/workflows/smoke-test.yaml

@@ -1,21 +0,0 @@
-# Smoke test: confirms Gitea Act Runner is online and accepting jobs.
-# Run manually via workflow_dispatch after runner is registered (#77).
-# Closes leeworks-agents/api-company#96
-
-name: Runner Smoke Test
-
-on:
-  workflow_dispatch:
-
-jobs:
-  smoke:
-    name: Smoke Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Confirm runner is online
-        run: |
-          echo "Runner is online!"
-          echo "Job ID: $GITHUB_JOB"
-          echo "Runner OS: $(uname -a)"
-          echo "Date: $(date -u)"
-          echo "Smoke test PASSED"

flux/api-company-source/kustomization.yaml

@@ -1,7 +1,8 @@
 # This manifest is FOR REFERENCE — the live version must be committed to
-# 0xWheatyz/Talos at testing1/first-cluster/cluster/flux/api-company/
+# 0xWheatyz/Talos at testing1/first-cluster/cluster/flux/api-company-source/
 #
 # See leeworks-agents/api-company#2
+# See leeworks-agents/api-company#97
 
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -17,3 +18,8 @@ spec:
   prune: true
   wait: true
   timeout: 5m
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: grafana-admin
+        optional: false