feat(auth): support per-deploy login password key override

Multi-replica deployments need every Pod/container to share one RSA private key, otherwise public keys handed to the browser may not match the key that decrypts the resulting ciphertext. Introduce a `*.local.yaml` override layer that ops-config and tenant-config both load on top of the base config, ship example overrides plus compose/k3s wiring, and tolerate PEM bodies that arrive folded or escaped from Secrets.

server/internal/ops/config/config.go

@@ -268,10 +268,12 @@ func RestartRequired(changes []FieldChange) bool {
 }
 
 func load(path string) (*Config, error) {
-	resolved := configruntime.New(configruntime.WithSource(
-		runtimefile.NewSource(path),
-		runtimeenv.NewSource("OPS"),
-	))
+	sources := []configruntime.Source{runtimefile.NewSource(path)}
+	if localPath := localOverridePath(path); localPath != "" {
+		sources = append(sources, runtimefile.NewSource(localPath))
+	}
+	sources = append(sources, runtimeenv.NewSource("OPS"))
+	resolved := configruntime.New(configruntime.WithSource(sources...))
 	defer resolved.Close()
 
 	if err := resolved.Load(); err != nil {
@@ -571,12 +573,37 @@ func watchFiles(path string) []string {
 	if strings.TrimSpace(path) == "" {
 		return nil
 	}
-	return []string{path}
+	files := []string{path}
+	if localPath := localOverridePath(path); localPath != "" {
+		files = append(files, localPath)
+	}
+	return files
 }
 
 func watchNames(path string) []string {
 	if strings.TrimSpace(path) == "" {
 		return nil
 	}
-	return []string{filepath.Base(path)}
+	names := []string{filepath.Base(path)}
+	if localPath := localOverridePath(path); localPath != "" {
+		names = append(names, filepath.Base(localPath))
+	}
+	return names
+}
+
+func localOverridePath(path string) string {
+	trimmed := strings.TrimSpace(path)
+	if trimmed == "" {
+		return ""
+	}
+	ext := filepath.Ext(trimmed)
+	base := strings.TrimSuffix(trimmed, ext)
+	if strings.HasSuffix(base, ".local") {
+		return ""
+	}
+	localPath := base + ".local" + ext
+	if _, err := os.Stat(localPath); err != nil {
+		return ""
+	}
+	return localPath
 }