docs: restructure self-hosting kubernetes guide (#4481)

Restructures the Kubernetes self-hosting guide around two explicit paths
- an **evaluation install** (bundled datastores, one command) and a
**production install** (external datastores, your own secrets) - so
every configuration decision belongs to one path or the other instead of
being a flat list of options with caveats.

Also in this pass:

- Adds an architecture overview (component-to-`values.yaml` map) and a
post-install "verify it" step.
- Consolidates the previously scattered upgrade notes into a single
collapsible group, and cuts implementation detail and historical asides
that no longer apply.
- Removes a duplicated object-storage section (two configs in two
styles) and trims the Docker ClickHouse note down to what a self-hoster
needs to act on.

Author: nicktrn

docs/self-hosting/docker.mdx

@@ -365,12 +365,10 @@ We patch the latest released version line only, so keep an eye on new releases t
 You can also lock the versions of the bundled services, for example with `CLICKHOUSE_IMAGE_TAG`. If you do, or if you bring your own ClickHouse via `CLICKHOUSE_URL`, note that Trigger.dev requires ClickHouse 25.8 or newer.
 
 <Note>
-  The bundled ClickHouse now uses the official `clickhouse/clickhouse-server` image. Your existing
-  data volume carries over automatically. If you previously pinned `CLICKHOUSE_IMAGE_TAG` to a
-  Bitnami tag (for example `25.7.5-debian-12-r0`), update it to an official image tag such as
-  `26.2` — Bitnami tags don't exist in the official repository. Note the switch is one-way: the
-  official image takes ownership of the data files, so rolling back to the Bitnami image requires
-  manually restoring their previous owner (`chown -R 1001:1001` on the volume).
+  The bundled ClickHouse uses the official `clickhouse/clickhouse-server` image, and your existing
+  data volume carries over automatically on upgrade. If you pinned `CLICKHOUSE_IMAGE_TAG` to a
+  Bitnami tag, switch it to an official tag (for example `26.2`) — Bitnami tags don't exist in the
+  official repository.
 </Note>
 
 <Note>

docs/self-hosting/env/webapp.mdx

@@ -12,7 +12,7 @@ mode: "wide"
 | `MAGIC_LINK_SECRET`                              | Yes      | —                     | Magic link encryption secret. Run: `openssl rand -hex 16`                                                          |
 | `ENCRYPTION_KEY`                                 | Yes      | —                     | Secret store encryption key. Run: `openssl rand -hex 16`                                                           |
 | `MANAGED_WORKER_SECRET`                          | Yes      | —                     | Managed worker secret. Must be set and match supervisor. Run: `openssl rand -hex 32`                               |
-| `ALLOW_INSECURE_DEFAULT_SECRETS`                 | No       | false                 | Boot even if a secret is still a known-insecure published default. Temporary escape hatch for values you can't safely rotate yet (see [Secret generation and rotation](/self-hosting/kubernetes#secret-generation-and-rotation)). |
+| `ALLOW_INSECURE_DEFAULT_SECRETS`                 | No       | false                 | Boot even if a secret is still a known-insecure published default. Temporary escape hatch for values you can't safely rotate yet (see [Secrets](/self-hosting/kubernetes#secrets)). |
 | **Domains & ports**                              |          |                       |                                                                                                                    |
 | `REMIX_APP_PORT`                                 | No       | 3030                  | Remix app port.                                                                                                    |
 | `APP_ORIGIN`                                     | Yes      | http://localhost:3030 | App origin URL.                                                                                                    |