helm: add first-class STT config to chart

[chaodu-agent]

Summary

Add stt as a first-class config block in the Helm chart, eliminating the need to manually patch configmaps after helm upgrade.

Closes #227

Before (manual patching required)

helm upgrade openab openab/openab --set agents.kiro.env.GROQ_API_KEY=gsk_xxx
# then manually patch configmap to add [stt] block
# then kubectl rollout restart

After (single command)

helm upgrade openab openab/openab \
  --set agents.kiro.stt.enabled=true \
  --set agents.kiro.stt.apiKey=gsk_xxx

Changes

File	Change
values.yaml	Add stt defaults (enabled, apiKey, model, baseUrl)
configmap.yaml	Render [stt] section when enabled, using ${STT_API_KEY} env var
secret.yaml	Store apiKey in K8s Secret (same pattern as discord.botToken)
deployment.yaml	Inject STT_API_KEY env var from Secret

Design

Follows the existing DISCORD_BOT_TOKEN pattern — API key is stored in a K8s Secret and injected as an env var, never in plaintext in the configmap:

values.yaml          Secret              Deployment env        ConfigMap
stt.apiKey ────► stt-api-key ────► STT_API_KEY ────► ${STT_API_KEY}

All STT fields are optional. When stt.enabled is false (default), no STT resources are rendered.

[thepagent]

Review

Clean PR that follows existing chart patterns well. A few observations:

👍 What looks good

• Follows the established DISCORD_BOT_TOKEN pattern — API key in K8s Secret, injected as env var, referenced as ${STT_API_KEY} in configmap. No plaintext leakage.
• All STT resources conditionally rendered only when stt.enabled=true — zero impact on existing deployments.
• Good defaults in values.yaml (Groq endpoint, whisper-large-v3-turbo).
• Docs updated in both docs/stt.md and README.md.

⚠️ Suggestion: add apiKey validation

In configmap.yaml, the [stt] block is rendered when stt.enabled is true, even if apiKey is empty. However deployment.yaml gates the env var on both enabled AND apiKey, so ${STT_API_KEY} would remain as a literal string at runtime.

Consider adding a validation check:

{{- if and ($cfg.stt).enabled (not ($cfg.stt).apiKey) }}
  {{ fail "stt.apiKey is required when stt.enabled=true" }}
{{- end }}

This gives users a clear error at helm upgrade time instead of a confusing runtime failure.

Minor

• Consider squashing the 3 commits into one on merge for cleaner history.

Overall looks good to merge once the apiKey validation is addressed. 👍

[chaodu-agent]

Thanks for the review! Addressed:

• apiKey validation — added fail in configmap.yaml that triggers at helm upgrade time when stt.enabled=true but apiKey is empty. Error message includes the agent name for clarity: agents.kiro.stt.apiKey is required when stt.enabled=true. See commit 3b18be0.

• Squash on merge — will use "Squash and merge" to keep history clean.

[thepagent]

LGTM! apiKey validation addressed — clean fail-fast at helm upgrade time with the agent name in the error message. Ship it. 🚀