helm: add first-class STT config to chart

[thepagent]

Problem

Enabling STT (Speech-to-Text) in the Helm chart requires manually patching the configmap after helm upgrade because the chart template has no [stt] section. The API key also ends up in plaintext in the configmap via agents.kiro.env.

Current workaround:

1. helm upgrade with --set agents.kiro.env.GROQ_API_KEY=...
2. Manually patch configmap to add [stt] block
3. kubectl rollout restart

This is error-prone and breaks the single-command install/upgrade experience.

Proposed Solution

Add stt as a first-class config block under each agent in the Helm chart.

User experience (after fix)

helm upgrade openab openab/openab \
  --set agents.kiro.stt.enabled=true \
  --set agents.kiro.stt.apiKey="gsk_xxx"

No manual patching, no extra restart.

Implementation

1. values.yaml — add stt defaults under each agent:

   stt:
     enabled: false
     apiKey: ""
     model: "whisper-large-v3-turbo"
     baseUrl: "https://api.groq.com/openai/v1"

2. configmap.yaml — render [stt] section when enabled, referencing env var (not plaintext):

   [stt]
   enabled = true
   api_key = "${STT_API_KEY}"
   model = "whisper-large-v3-turbo"

3. Secret template — store stt.apiKey in the K8s Secret (same pattern as discord.botToken)

4. Deployment template — inject STT_API_KEY from Secret as env var

This keeps the API key out of the configmap and follows the existing pattern used for DISCORD_BOT_TOKEN.

[thepagent]

UX comparison

Current (without this fix)

Basic install is 4 steps. Adding STT requires 3 more:

# Steps 1-2: helm install (basic)
# Step 3: kubectl exec -it ... kiro-cli login --use-device-flow
# Step 4: kubectl rollout restart

# Step 5: helm upgrade with --set agents.kiro.env.GROQ_API_KEY=...
# Step 6: kubectl patch configmap to add [stt] block
# Step 7: kubectl rollout restart (again)

7 steps total, 2 restarts, manual configmap patching.

After this fix

STT becomes two extra --set flags at install time:

helm install openab openab/openab \
  --set-string agents.kiro.discord.allowedChannels[0]="CHANNEL_ID" \
  --set agents.kiro.discord.botToken="TOKEN" \
  --set agents.kiro.stt.enabled=true \
  --set agents.kiro.stt.apiKey="gsk_xxx"

kubectl exec -it deployment/openab-kiro -- kiro-cli login --use-device-flow
kubectl rollout restart deployment/openab-kiro

4 steps total, 1 restart, zero manual patching.