fix(mudcraft): substitute LP_PASSWORD in LuckPerms config at init time

LuckPerms reads config.yml as a literal string — ${LP_PASSWORD} was
never being substituted, causing auth failures against PostgreSQL.
initContainer now has the secret injected as an env var and uses sed
to write the real password into the config before LuckPerms reads it.

Also adds faultexception to WHITELIST so they can connect.

servers/legion/k8s/mudcraft/configmap.yaml

@@ -22,6 +22,7 @@ data:
   ENFORCE_WHITELIST: "true"
   WHITELIST_ENABLED: "true"
   OPS: "faultexception"
+  WHITELIST: "faultexception"
   ENABLE_RCON: "true"
   RCON_PORT: "25575"
   MOTD: "MUDCraft — Private Beta"

servers/legion/k8s/mudcraft/statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       labels:
         app: mudcraft
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-03-30T02:30:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-03-30T02:45:00Z"
     spec:
       terminationGracePeriodSeconds: 120
       securityContext:
@@ -32,6 +32,12 @@ spec:
           securityContext:
             runAsUser: 1000
             runAsGroup: 1000
+          env:
+            - name: LP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mudcraft-secrets
+                  key: db-password
           command:
             - sh
             - -c
@@ -39,7 +45,7 @@ spec:
               rm -rf /target/*.jar
               cp -r /plugins/* /target/
               mkdir -p /target/LuckPerms
-              cp /luckperms-config/config.yml /target/LuckPerms/config.yml
+              sed "s|\${LP_PASSWORD}|${LP_PASSWORD}|g" /luckperms-config/config.yml > /target/LuckPerms/config.yml
               mkdir -p /target/PurpurExtras
               cp /purpurextras-config/config.yml /target/PurpurExtras/config.yml
               echo 'Plugins installed'