docs(helm): list PLACES_API_KEY and VAPID_PRIVATE_KEY among existingSecret keys

charts/trek/templates/NOTES.txt

@@ -5,8 +5,8 @@
    - To use an existing Kubernetes secret, set `existingSecret` to the secret name. The chart then
      renders no Secret of its own and reads every secret env var from that secret: `ENCRYPTION_KEY`
      (renamable via `existingSecretKey`), plus `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `OIDC_CLIENT_SECRET`,
-     `UNSPLASH_ACCESS_KEY`, `AMAP_API_KEY` and `AMAP_API_SECRET`. Missing keys are simply left unset,
-     so only provide the ones you use.
+     `UNSPLASH_ACCESS_KEY`, `PLACES_API_KEY`, `AMAP_API_KEY`, `AMAP_API_SECRET` and
+     `VAPID_PRIVATE_KEY`. Missing keys are simply left unset, so only provide the ones you use.
    - If left empty, the server resolves the key automatically: existing installs fall back to
      data/.jwt_secret (encrypted data stays readable with no manual action); fresh installs
      auto-generate a key persisted to the data PVC.

charts/trek/values.yaml

@@ -174,8 +174,9 @@ generateEncryptionKey: false
 # If set, the chart renders no Secret of its own and instead reads every secret env
 # var from this existing Kubernetes secret. Expected keys: ENCRYPTION_KEY (rename via
 # existingSecretKey), ADMIN_EMAIL, ADMIN_PASSWORD, OIDC_CLIENT_SECRET,
-# UNSPLASH_ACCESS_KEY, AMAP_API_KEY, AMAP_API_SECRET. Missing keys are simply left
-# unset (they are optional), so only provide the ones your setup needs.
+# UNSPLASH_ACCESS_KEY, PLACES_API_KEY, AMAP_API_KEY, AMAP_API_SECRET,
+# VAPID_PRIVATE_KEY. Missing keys are simply left unset (they are optional), so only
+# provide the ones your setup needs.
 existingSecret: ""
 existingSecretKey: ENCRYPTION_KEY