fix: add ACTUAL_E2E_PASSWORD_1 to actual-budget-exporter

Budget is E2E-encrypted; exporter fails with 'File ... is encrypted' without
this. Sourced from the same hand-created Secret as the other credentials.

README.md

@@ -86,16 +86,20 @@ Visit `http://ignis.fireflylab.local` once the pod is Ready.
 - No HTTPRoute — this only serves `/metrics`. A `ServiceMonitor` (labeled
   `release: kube-prometheus-stack` to match that stack's default selector)
   gets it scraped by the cluster Prometheus instead.
-- `ACTUAL_PASSWORD` / `ACTUAL_BUDGET_ID_1` are **not** in `values.yaml` —
-  plaintext Actual credentials don't belong in a git-committed file. They
-  come from a Secret you create by hand once, after the Application syncs
-  and the `actualbudget` namespace exists:
+- `ACTUAL_PASSWORD` / `ACTUAL_BUDGET_ID_1` / `ACTUAL_E2E_PASSWORD_1` are
+  **not** in `values.yaml` — plaintext Actual credentials don't belong in a
+  git-committed file. They come from a Secret you create by hand once, after
+  the Application syncs and the `actualbudget` namespace exists.
+  `ACTUAL_E2E_PASSWORD_1` is required if the budget has E2E encryption
+  enabled — the exporter fails with `File ... is encrypted. Please provide a
+  password.` otherwise; pass an empty string if the budget isn't encrypted:
 
   ```bash
   kubectl create secret generic actual-budget-exporter-secrets \
     -n actualbudget \
     --from-literal=ACTUAL_PASSWORD='<your actual budget password>' \
-    --from-literal=ACTUAL_BUDGET_ID_1='<sync ID from Settings → Show advanced settings>'
+    --from-literal=ACTUAL_BUDGET_ID_1='<sync ID from Settings → Show advanced settings>' \
+    --from-literal=ACTUAL_E2E_PASSWORD_1='<E2E encryption password, empty string if none>'
   ```
 
   Restart the deployment after creating/rotating it: