refactor: serve static frontend with Go APIs

deploy/ack/secrets.example.yaml

@@ -25,12 +25,12 @@ stringData:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: zhinian-web-auth
+  name: zhinian-go-auth
   namespace: zhinian
 type: Opaque
 stringData:
-  # Shared by the Next.js middleware and the Go backend so both verify the
-  # same session cookies. Keep identical across workloads.
+  # Go is the sole owner of session creation and verification. Static Web never
+  # receives this signing secret.
   ZHINIAN_AUTH_SESSION_SECRET: REPLACE_WITH_A_DIFFERENT_LONG_RANDOM_VALUE
 ---
 apiVersion: v1