🤖 docs: keep the standalone aggregated API server session token in a Secret

編集するファイルは docs/how-to/deploy-aggregated-apiserver.md です。既存の「Option B: standalone」セクションを読んで、現在の Deployment 仕様を理解してください。Kubernetes Secret マニフェストを作成し、Deployment を valueFrom.secretKeyRef と $(VAR) 展開を使用するように変更します。クラスター上でテストし、集約 API サーバーが認証を行い、トークンが Deployment 仕様に表示されなくなることを確認してください。

Problem

docs/how-to/deploy-aggregated-apiserver.md "Option B: standalone" passes the Coder admin session token as a literal --coder-session-token=... argument. The token then sits in plain text in the Deployment spec, and anyone who can read Deployments in coder-system can see it. This practice predates #126, which only fixed the command syntax.

Proposal

No code change is needed. Store the token in a Secret, expose it to the container as an environment variable with valueFrom.secretKeyRef, and reference it in the args with Kubernetes $(VAR) expansion, for example --coder-session-token=$(CODER_SESSION_TOKEN). Update the docs to show this, and verify on a real cluster that the server authenticates and the Deployment spec no longer contains the token.

Owner and trigger

Owner: maintainer desk. Start after #126 lands, because it edits the same block.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh