chore(secrets): rotate the MokerLink community

[Gerrrt]

Commits a rotation that was already applied to the device and the working tree but never committed.

What changed

SNMP_COMMUNITY_MOKERLINK only. One key, values encrypted.

Why

The MokerLink switch is the device #9 never reached. It has now been rotated,
and snmp-exporter scrapes it clean at 0 retries with this value — so the
credential is verified against the hardware.

But HEAD still carried the previous value, which no device has ever accepted.
A fresh clone or a second host would have rendered that one and polled with a
community the switch does not know. git log also had no record that the
rotation happened, which the rotation runbook’s §3 exists to prevent.

Blast radius

Secrets file only. No config, no service definition, no segmentation change.
The running stack already holds this value — make render was run when the
switch was rotated — so no redeploy is needed and nothing changes on merge.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

up{job="snmp"}   all four = 1
neo 10.7.7.2     snmp_scrape_packets_retried = 0

CI asserts the file is still genuinely encrypted and that no decrypted artefact
is tracked.

• make validate passes
• Deployed to the lab and confirmed working
• Docs updated — n/a, status already recorded in SECURITY.md

Refs #9