Use {{APP_SECRETS}} for renderer + license secret references

{{APP_NAME}}-secrets expanded to a per-app secret name, which would
require a new Control Plane Secret for every review app PR — wrong
per cpflow's own conventions.

cpflow exposes {{APP_SECRETS}} (lib/core/template_parser.rb:49,
lib/core/config.rb:51-52) which expands to `{APP_PREFIX}-secrets`.
Per our controlplane.yml, APP_PREFIX is:
  - `react-webpack-rails-tutorial-production` for the prod app
  - `react-webpack-rails-tutorial-staging` for the staging app
  - `qa-react-webpack-rails-tutorial` for all qa-* review apps
    (because match_if_app_name_starts_with: true)

So review apps all share `qa-react-webpack-rails-tutorial-secrets`
instead of each PR needing its own. Three secrets total across two
orgs instead of one per PR.

Matches the `{APP_PREFIX}-secrets` default documented at
shakacode/control-plane-flow/docs/secrets-and-env-values.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ihabadham

.controlplane/templates/app.yml

@@ -34,12 +34,15 @@ spec:
       value: '2'
     - name: RENDERER_URL
       value: http://localhost:3800
-    # RENDERER_PASSWORD and REACT_ON_RAILS_PRO_LICENSE must be created as a
-    # Control Plane Secret named `<app>-secrets` in each org before deploy.
+    # RENDERER_PASSWORD and REACT_ON_RAILS_PRO_LICENSE must be created in the
+    # Control Plane Secret named by {{APP_SECRETS}} before deploy. cpflow
+    # resolves {{APP_SECRETS}} to `{APP_PREFIX}-secrets` — which means review
+    # apps all share one `qa-react-webpack-rails-tutorial-secrets` (thanks to
+    # match_if_app_name_starts_with: true on the qa template).
     - name: RENDERER_PASSWORD
-      value: cpln://secret/{{APP_NAME}}-secrets.RENDERER_PASSWORD
+      value: cpln://secret/{{APP_SECRETS}}.RENDERER_PASSWORD
     - name: REACT_ON_RAILS_PRO_LICENSE
-      value: cpln://secret/{{APP_NAME}}-secrets.REACT_ON_RAILS_PRO_LICENSE
+      value: cpln://secret/{{APP_SECRETS}}.REACT_ON_RAILS_PRO_LICENSE
   # Part of standard configuration
   staticPlacement:
     locationLinks: