Add Woodpecker secrets for AI_API_KEY, AI_AGENT_SIMPLE, and TURNSTILE_SECRET_KEY. Create ci-secrets.yaml template and wire them through the deploy step alongside existing SMTP secrets.