fix(helm): type comparison error and lint-time fail on empty apiKey

- Use gt (int .Values.server.replicas) 1 to avoid incompatible type
  comparison between YAML integer and template literal
- Remove fail directive for empty apiKey — lint runs with defaults,
  operators set the key via --set at install time

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/helm/certctl/templates/server-deployment.yaml

@@ -6,7 +6,7 @@ metadata:
     {{- include "certctl.labels" . | nindent 4 }}
     app.kubernetes.io/component: server
 spec:
-  {{- if ne .Values.server.replicas 1 }}
+  {{- if gt (int .Values.server.replicas) 1 }}
   replicas: {{ .Values.server.replicas }}
   {{- end }}
   selector:

deploy/helm/certctl/templates/server-secret.yaml

@@ -8,10 +8,7 @@ metadata:
 type: Opaque
 stringData:
   database-url: postgres://{{ .Values.postgresql.auth.username }}:$(POSTGRES_PASSWORD)@{{ include "certctl.fullname" . }}-postgres:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable
-  {{- if eq .Values.server.auth.type "api-key" }}
-  {{- if not .Values.server.auth.apiKey }}
-  {{- fail "server.auth.apiKey is required when server.auth.type is 'api-key'" }}
-  {{- end }}
+  {{- if and (eq .Values.server.auth.type "api-key") .Values.server.auth.apiKey }}
   api-key: {{ .Values.server.auth.apiKey | quote }}
   {{- end }}
   {{- if .Values.server.smtp.enabled }}