Add OpenAI integration to Mealie

Enable recipe parsing from images/photos, ingredient extraction, and
URL scraping via OpenAI API (gpt-4o). Rename ExternalSecret from
mealie-oidc to mealie-secrets to hold both OIDC and OpenAI credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

argocd/manifests/mealie/deployment.yaml

@@ -39,8 +39,8 @@ spec:
             - name: OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: mealie-oidc
+                  name: mealie-secrets
-                  key: client-secret
+                  key: oidc-client-secret
             - name: OIDC_AUTO_REDIRECT
               value: "false"
             - name: OIDC_PROVIDER_NAME
@@ -51,6 +51,18 @@ spec:
               value: "true"
             - name: OIDC_USER_CLAIM
               value: "email"
+            # OpenAI — recipe parsing, image OCR, ingredient extraction
+            - name: OPENAI_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: mealie-secrets
+                  key: openai-api-key
+            - name: OPENAI_MODEL
+              value: "gpt-4o"
+            - name: OPENAI_REQUEST_TIMEOUT
+              value: "120"
+            - name: OPENAI_WORKERS
+              value: "1"
           volumeMounts:
             - name: data
               mountPath: /app/data

argocd/manifests/mealie/external-secret.yaml

@@ -2,7 +2,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: mealie-oidc
+  name: mealie-secrets
   namespace: mealie
 spec:
   refreshInterval: 1h
@@ -10,10 +10,14 @@ spec:
     kind: ClusterSecretStore
     name: onepassword-blumeops
   target:
-    name: mealie-oidc
+    name: mealie-secrets
     creationPolicy: Owner
   data:
-    - secretKey: client-secret
+    - secretKey: oidc-client-secret
       remoteRef:
         key: "Authentik (blumeops)"
         property: mealie-client-secret
+    - secretKey: openai-api-key
+      remoteRef:
+        key: "openai (blumeops)"
+        property: credential