blog: add outbound + secret-zero hero images

outbound-only-exposure (corrected sealed-vault image) + secret-zero (the seed-
key circuit-tree, _R revision). Both verified against their prompts, optimized
to webp (17KB / ~120KB). Completes hero coverage for all 6 posts.

src/content/blog/outbound-only-exposure.md

@@ -4,6 +4,9 @@ date: 2026-06-23
 summary: "Exposing self-hosted services to the internet with zero open ports, zero port-forwarding, and the origin's IP never leaving the building."
 tags: ["cloudflare", "networking", "security", "zero-trust", "kubernetes"]
 draft: false
+hero: "/blog/outbound-only-exposure.webp"
+heroAlt: "A smooth sealed dark monolith with no doors; a single thin thread of light arcs out from inside it to a distant glowing cloud-edge node."
+
 ---
 
 The default way to put a home service on the internet is to forward a port: poke a hole in the router, map

src/content/blog/secret-zero.md

@@ -4,6 +4,9 @@ date: 2026-06-28
 summary: "Secrets management has a bootstrap paradox: the credential that pulls every other secret can't itself live in git. Here's how a homelab fleet breaks the cycle — zero plaintext secrets in any repo, and a clean rule for which is the one exception."
 tags: ["security", "gitops", "secrets", "kubernetes", "external-secrets"]
 draft: false
+hero: "/blog/secret-zero.webp"
+heroAlt: "A single glowing seed-shaped key at the base of a dark circuit-board tree whose traces branch upward into hundreds of faint nodes, all drawing their glow from that one source."
+
 ---
 
 ![A single glowing seed-key at the root of a circuit-board tree](/blog/secret-zero.webp)