fix: switch to Consul KV template for secrets injection

- Consul now running on int node (joined cluster)
- provider=consul re-enabled (int has consul.version=1.22.7)
- Removed sed placeholder approach + Gitea secrets requirement
- Added template{} stanzas reading from consul kv mmd/* keys
- Cleaned up deploy.yml (removed sed substitution step)

.gitea/workflows/deploy.yml

@@ -80,23 +80,13 @@ jobs:
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
-    - name: Substitute secrets into Nomad job
-      run: |
-        sed \
-          -e "s|__DATABASE_URL__|${{ secrets.DATABASE_URL }}|g" \
-          -e "s|__ANTHROPIC_API_KEY__|${{ secrets.ANTHROPIC_API_KEY }}|g" \
-          -e "s|__SAXO_APP_KEY__|${{ secrets.SAXO_APP_KEY }}|g" \
-          -e "s|__SAXO_APP_SECRET_1__|${{ secrets.SAXO_APP_SECRET_1 }}|g" \
-          -e "s|__SAXO_BASE__|${{ secrets.SAXO_BASE }}|g" \
-          mmd.nomad > mmd_deploy.nomad
-
     - name: Validate Nomad job
-      run: nomad job validate mmd_deploy.nomad
+      run: nomad job validate mmd.nomad
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
     - name: Deploy to Nomad
-      run: nomad job run mmd_deploy.nomad
+      run: nomad job run mmd.nomad
       env:
         NOMAD_ADDR: "https://nomad.i80.dk:4646"