docs: add secrets-checklist.md with kubectl commands for all required secrets

Closes leeworks-agents/api-company#43

Creates docs/secrets-checklist.md containing:
- Human operator checklist (7 checkboxes)
- Exact kubectl create secret commands for all required secrets
- Source of each secret value (Gitea admin UI, Slack, etc.)
- Which issues are unblocked by each secret
- Dependency order diagram

Secrets covered:
1. gitea-leeworks-agents-token (flux-system) → unblocks Flux GitRepo auth (#2)
2. gitea-runner-token (gitea-runner) → unblocks act-runner (#3)
3. grafana-admin (monitoring) → unblocks Grafana (#7)
4. gatus-slack-webhook (monitoring) → unblocks Gatus alerts (#8)
5. GITEA_TOKEN Actions secret (per repo) → unblocks CI image push
6. Gitea packages enable + DNS → unblocks registry (#4)
7. Flux source in Talos repo → unblocks GitOps (#2)

STATUS.md

@@ -1,6 +1,6 @@
 # Company Status
 
-_Last updated: 2026-05-25 (agent cycle)_
+_Last updated: 2026-05-26 (agent cycle)_
 
 ## APIs
 | API            | Spec | Code | Deployed | Listed on RapidAPI | Paying Users | MRR |
@@ -19,7 +19,15 @@ Legend: [x]=done, [~]=in-progress, [ ]=not started
 - **Prometheus + Grafana:** Flux HelmRelease at `flux/monitoring/` — PENDING Flux wiring + Grafana secret (issue #7)
 - **Gatus status page:** Flux HelmRelease at `flux/monitoring/gatus-helmrelease.yaml` — PENDING Flux wiring (issue #8)
 
-## Flux Manifests (`kustomize build flux/` = PASS)
+## Completed This Cycle (2026-05-26)
+- **#36** — Cluster audit committed to `docs/cluster-audit.md` (closed)
+- **#40** — Legal docs (ToS, Privacy Policy, AUP) under `docs/legal/` (closed)
+- **#37** — docs-site Astro skeleton with Redoc pages; `npm run build` passes (closed)
+- **#39** — SEO blog posts (ZIP, Holidays, Air Quality) in `docs-site/src/pages/blog/` (closed)
+- **#38** — Gitea Actions CI workflow (`.gitea/workflows/build-docs.yaml`) + Dockerfile (closed)
+- **#34** — Cluster audit PR merged
+
+## Flux Manifests (kustomize build flux/ = PASS)
 All flux manifests validate successfully. Deployed components pending Flux activation:
 - `gitea-runner` namespace + HelmRelease (gitea-act-runner chart)
 - `monitoring` namespace + kube-prometheus-stack HelmRelease
@@ -33,6 +41,7 @@ All flux manifests validate successfully. Deployed components pending Flux activ
 4. **Enable Gitea packages** (`[packages] ENABLED=true` in app.ini) + DNS record `registry.leeworks.dev` → Gitea ingress
 5. **Create Grafana admin secret** in `monitoring` namespace (`GRAFANA_ADMIN_PASSWORD`)
 6. **Create Slack webhook secret** in `monitoring` namespace for Gatus alerts
+7. **DNS A records** for all 6 subdomains (zip, holidays, aqi, docs, status, registry) → cluster ingress IP (issue #33)
 
 ## API Repos Status
 - `zip-enrichment`: Phase 3 server in progress (Fastify scaffold, routes, CI workflows)
@@ -46,6 +55,6 @@ All flux manifests validate successfully. Deployed components pending Flux activ
 - Gap: $100
 
 ## Next actions
-1. **Human operator:** unblock infrastructure (items 1-6 above)
+1. **Human operator:** unblock infrastructure (items 1-7 above)
 2. Once runner + Flux are live: API repo CI will build/push images and deploy to cluster
 3. Phase 1→2→3 completion across zip-enrichment, holidays, air-quality repos

docs/secrets-checklist.md

@@ -0,0 +1,167 @@
+# Kubernetes Secrets Checklist
+
+All infrastructure blockers reduce to creating six Kubernetes secrets and one Gitea Actions secret.
+Follow this list top-to-bottom; each step unblocks the next.
+
+**Human operator only** — the agent cannot log into Gitea's admin panel or run `kubectl` in the cluster.
+
+---
+
+## Checklist
+
+- [ ] 1. `gitea-leeworks-agents-token` (flux-system) — unblocks Flux GitRepository auth
+- [ ] 2. `gitea-runner-token` (gitea-runner) — unblocks Gitea Actions runner registration
+- [ ] 3. `grafana-admin` (monitoring) — unblocks Grafana login
+- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications
+- [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push
+- [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry
+- [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation
+
+---
+
+## Secret Details
+
+### 1. `gitea-leeworks-agents-token`
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-leeworks-agents-token` |
+| Namespace | `flux-system` |
+| Purpose   | Flux `GitRepository` authenticates to Gitea over HTTPS to pull `leeworks-agents/api-company` |
+| Source    | Gitea web UI → User Settings → Applications → Generate Token (scopes: `read:repository`) |
+| Unblocks  | Issue #2 (Flux GitRepository + Kustomization for api-company) |
+
+```bash
+kubectl create secret generic gitea-leeworks-agents-token \
+  -n flux-system \
+  --from-literal=username=leeworks-agents \
+  --from-literal=password=<GITEA_TOKEN>
+```
+
+---
+
+### 2. `gitea-runner-token`
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gitea-runner-token` |
+| Namespace | `gitea-runner` |
+| Purpose   | The `gitea-act-runner` HelmRelease reads this token to register the runner with Gitea |
+| Source    | Gitea Admin Panel → Site Administration → Actions → Runners → **Create new Runner** — copy registration token |
+| Unblocks  | Issue #3 (gitea-act-runner Flux deployment) |
+
+```bash
+kubectl create secret generic gitea-runner-token \
+  -n gitea-runner \
+  --from-literal=token=<RUNNER_TOKEN>
+```
+
+After creating the secret, Flux reconciles the `gitea-act-runner` HelmRelease and the runner appears as **Online** in Gitea Admin → Actions → Runners.
+
+---
+
+### 3. `grafana-admin`
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `grafana-admin` |
+| Namespace | `monitoring` |
+| Purpose   | Sets the Grafana `admin` user password on first boot |
+| Source    | Choose a strong password and store it in a password manager |
+| Unblocks  | Issue #7 (Prometheus + Grafana HelmRelease) |
+
+```bash
+kubectl create secret generic grafana-admin \
+  -n monitoring \
+  --from-literal=admin-password=<PASSWORD>
+```
+
+Grafana will be accessible at `https://grafana.leeworks.dev` (login: `admin` / `<PASSWORD>`).
+
+---
+
+### 4. `gatus-slack-webhook`
+
+| Field     | Value |
+|-----------|-------|
+| Name      | `gatus-slack-webhook` |
+| Namespace | `monitoring` |
+| Purpose   | Gatus posts downtime alerts to a Slack channel via incoming webhook |
+| Source    | Slack → Your workspace → Apps → Incoming Webhooks → Add to Slack → copy webhook URL |
+| Unblocks  | Issue #8 (Gatus status page at `status.leeworks.dev`) |
+
+```bash
+kubectl create secret generic gatus-slack-webhook \
+  -n monitoring \
+  --from-literal=url=https://hooks.slack.com/services/YOUR/WEBHOOK/URL
+```
+
+---
+
+### 5. `GITEA_TOKEN` — Gitea Actions Secret (per repo)
+
+| Field    | Value |
+|----------|-------|
+| Name     | `GITEA_TOKEN` |
+| Scope    | Gitea Actions Secret — set in each repo's Settings, **not** a Kubernetes secret |
+| Purpose  | CI workflows use this token to push container images to `registry.leeworks.dev` |
+| Source   | Same token as step 1, or a dedicated CI token with `write:packages` scope |
+| Unblocks | CI pipelines for all three API repos |
+
+Set in Gitea web UI for **each** of these repos:
+- `leeworks-agents/api-company`
+- `leeworks-agents/zip-enrichment`
+- `leeworks-agents/holidays`
+- `leeworks-agents/air-quality`
+
+Path: **Repo → Settings → Actions → Secrets → Add Secret**
+- Name: `GITEA_TOKEN`
+- Value: `<GITEA_TOKEN>`
+
+---
+
+### 6. Enable Gitea Packages + DNS for `registry.leeworks.dev`
+
+This is a Gitea instance configuration step, not a Kubernetes secret.
+
+| Step | Action |
+|------|--------|
+| 6a   | Enable packages in Gitea `app.ini`: set `[packages] ENABLED = true` then restart Gitea |
+| 6b   | Add DNS A record: `registry.leeworks.dev` → cluster ingress IP |
+
+Find cluster ingress IP:
+```bash
+kubectl get svc -n ingress-nginx
+```
+
+See `docs/registry.md` for context on why the Gitea built-in registry was chosen.
+
+Unblocks: Issue #4 (container registry), and transitively all CI image-push workflows.
+
+---
+
+### 7. Add api-company Flux Source + Kustomization to 0xWheatyz/Talos
+
+Reference manifests are already committed at `flux/api-company-source/` in this repo.
+The operator must copy them into the Talos cluster repo so FluxCD picks them up:
+
+```
+0xWheatyz/Talos:testing1/first-cluster/cluster/flux/api-company-source/
+```
+
+Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo).
+
+---
+
+## Dependency Order
+
+```
+7 (Flux wiring)          → all flux/ resources reconcile
+1 (gitea-leeworks-token) → Flux can pull this repo over HTTPS
+2 (gitea-runner-token)   → runner online → CI runs
+3 (grafana-admin)        → Grafana login works
+4 (gatus-slack-webhook)  → Gatus alerting works
+5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy
+```
+
+Once all seven items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.