Fix Garage config: use top-level rpc fields, template admin_token

Garage v1.0.x uses top-level rpc_bind_addr/rpc_secret, not a [rpc]
section. Also template admin_token into [admin] from the sealed secret.

infra/kubernetes/platform/garage/configmap.yaml

@@ -7,15 +7,13 @@ data:
   garage.toml: |
     db_engine = "lmdb"
     replication_factor = 1
-    compression_level = 1
+    consistency_mode = "consistent"
 
     metadata_dir = "/mnt/meta"
     data_dir = "/mnt/data"
 
-    [rpc]
+    rpc_bind_addr = "[::]:3901"
-    bind_addr = "[::]:3901"
+    rpc_secret = "RPC_SECRET_PLACEHOLDER"
-    # Single-node: rpc_secret is only used for inter-node auth (N/A here)
-    rpc_secret = "PLACEHOLDER"
 
     [s3_api]
     api_bind_addr = "[::]:3900"
@@ -29,3 +27,4 @@ data:
 
     [admin]
     api_bind_addr = "[::]:3903"
+    admin_token = "ADMIN_TOKEN_PLACEHOLDER"

infra/kubernetes/platform/garage/statefulset.yaml

@@ -22,13 +22,20 @@ spec:
           command: ["sh", "-c"]
           args:
             - |
-              sed "s/PLACEHOLDER/$RPC_SECRET/" /config-tmpl/garage.toml > /config/garage.toml
+              sed -e "s/RPC_SECRET_PLACEHOLDER/$RPC_SECRET/" \
+                  -e "s/ADMIN_TOKEN_PLACEHOLDER/$ADMIN_TOKEN/" \
+                  /config-tmpl/garage.toml > /config/garage.toml
           env:
             - name: RPC_SECRET
               valueFrom:
                 secretKeyRef:
                   name: garage-credentials
                   key: rpc-secret
+            - name: ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: garage-credentials
+                  key: admin-token
           volumeMounts:
             - name: config-tmpl
               mountPath: /config-tmpl
@@ -46,12 +53,6 @@ spec:
               name: web
             - containerPort: 3903
               name: admin
-          env:
-            - name: GARAGE_ADMIN_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: garage-credentials
-                  key: admin-token
           resources:
             requests:
               memory: 256Mi