k8s: exclude passthrough source keys from jbod-mqtt secret

excludeRaw alone left all home_assistant source keys (api_key, vantage_*, etc.)
in the synced secret, so envFrom injected them into the web container. Add
transformation.excludes ['.*'] so only the templated MQTT_USERNAME/MQTT_PASSWORD
remain.

k8s/mqtt-vaultstaticsecret.yaml

@@ -23,6 +23,11 @@ spec:
     create: true
     transformation:
       excludeRaw: true
+      # Drop ALL passthrough source keys (api_key, vantage_*, etc.) — keep only
+      # the templated MQTT_USERNAME/MQTT_PASSWORD below. Without this, envFrom
+      # would inject the entire home_assistant secret into the web container.
+      excludes:
+        - ".*"
       templates:
         MQTT_USERNAME:
           text: '{{ .Secrets.mqtt_user }}'