Fix newsletter database secret ref deploy

[suguanYang]

Summary

• Remove GitHub Actions newsletter database URL interpolation from the dashboard deploy workflow.
• Stop setting NEWSLETTER_DATABASE_URL as a literal deployment env var.
• Patch NEWSLETTER_DATABASE_URL as an optional Kubernetes secretKeyRef to knowhere-secrets/newsletter-database-url before rolling out the image.
• Update README deployment notes to document optional secret behavior and fallback to DATABASE_URL.

Verification

• pnpm test: passed, 13 test files and 65 tests
• pnpm lint: passed with existing warnings
• pnpm type-check: passed
• CI-style pnpm build: passed with build-validation environment
• git diff --check: passed

Manual browser checks: not applicable, deployment workflow and docs only.

Screenshots or Recordings

Not applicable for non-UI changes.

Deployment Notes

• NEWSLETTER_DATABASE_URL is now delivered from optional Kubernetes Secret key knowhere-secrets/newsletter-database-url when present.
• Missing secret key no longer blocks deploy; the app keeps existing fallback behavior to DATABASE_URL.
• The deploy removes any existing literal NEWSLETTER_DATABASE_URL entry before patching the optional secret ref.
• Rollback is the normal workflow rollback; no database migration is included.

Checklist

• Tests were added or updated when behavior changed
• Public docs, examples, or screenshots were updated when needed
• User-visible UI changes were checked on responsive layouts: not applicable, no UI changes
• Auth, billing, and API proxy changes avoid leaking secrets or user data
• The pull request description explains any breaking or user-visible change