fix: add ACTUAL_E2E_PASSWORD_1 to actual-budget-exporter

Budget is E2E-encrypted; exporter fails with 'File ... is encrypted' without
this. Sourced from the same hand-created Secret as the other credentials.

apps/actual-budget-exporter/chart/templates/deployment.yaml

@@ -34,6 +34,11 @@ spec:
                 secretKeyRef:
                   name: {{ .Values.secret.name }}
                   key: ACTUAL_BUDGET_ID_1
+            - name: ACTUAL_E2E_PASSWORD_1
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secret.name }}
+                  key: ACTUAL_E2E_PASSWORD_1
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           # No documented dedicated health endpoint; /metrics is the route

apps/actual-budget-exporter/chart/values.yaml

@@ -15,11 +15,13 @@ service:
 env:
   ACTUAL_SERVER_URL: "http://192.168.1.41:8002"
   # ACTUAL_BUDGET_NAME_1: ""    # optional, adds a friendly name to the prometheus label
-  # ACTUAL_E2E_PASSWORD_1: ""   # optional, only if E2E encryption is enabled on the budget
 
-# ACTUAL_PASSWORD and ACTUAL_BUDGET_ID_1 are NOT set here — plaintext Actual
-# credentials in a git-committed values.yaml is not acceptable. They're read
-# from a Secret you create by hand once (see README.md), never committed.
+# ACTUAL_PASSWORD, ACTUAL_BUDGET_ID_1, and ACTUAL_E2E_PASSWORD_1 are NOT set
+# here — plaintext Actual credentials don't belong in a git-committed
+# values.yaml. They're read from a Secret you create by hand once (see
+# README.md), never committed. ACTUAL_E2E_PASSWORD_1 is required whenever the
+# budget has E2E encryption enabled (exporter fails with "File ... is
+# encrypted" otherwise) — leave the key empty in the Secret if it isn't.
 secret:
   name: actual-budget-exporter-secrets