fix(UPM-81611): Use URL-safe base64 for Fernet key generation

The Fernet specification (https://github.com/fernet/spec/) requires
URL-safe base64 encoding (RFC 4648 Section 5), which uses `-` and `_`
instead of `+` and `/`. The existing `dd | base64` command produces
standard base64 which may contain `+` and `/` characters, making
the generated key non-compliant with the Fernet spec.

Add `| tr '+/' '-_'` to all Fernet key generation commands across
all doc versions (1.2, 1.3, preview).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jesswolfedb

product_docs/docs/edb-postgres-ai/1.2/hybrid-manager/ai-factory/enabling.mdx

@@ -13,7 +13,7 @@ If you haven't already generated a Fernet key, you will need to do this to enabl
 If you used any of the EDB Postgres AI Hybrid Manager `-install-secrets.sh` scripts to set up your environment, you may already have a Fernet key generated. If not, you can generate one using the following command in your terminal. Ensure you have `kubectl` configured to point to your EDB Postgres AI Hybrid Manager cluster:
 
 ```bash
-FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
 
 kubectl create namespace upm-griptape
 

product_docs/docs/edb-postgres-ai/1.2/hybrid-manager/install/customization/genai_secret.mdx

@@ -15,7 +15,7 @@ For EKS installations using the `eks-install-secrets.sh` script, you can skip ke
 1.  Create a Fernet key and store it in a variable:
 
     ```shell
-    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
     ```
 
     !!!note

product_docs/docs/edb-postgres-ai/1.2/hybrid-manager/install/eks/installing/assets-helm/eks-install-secrets.sh

@@ -31,7 +31,7 @@ kubectl annotate secret -n upm-replicator edb-cred replicator.v1.mittwald.de/rep
 
 kubectl create namespace upm-griptape
 
-FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
 
 kubectl apply -f - <<EOF
 apiVersion: v1

product_docs/docs/edb-postgres-ai/1.2/hybrid-manager/install/eks/installing/assets-op/eks-install-secrets.sh

@@ -31,7 +31,7 @@ kubectl annotate secret -n upm-replicator edb-cred replicator.v1.mittwald.de/rep
 
 kubectl create namespace upm-griptape
 
-FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
 
 kubectl apply -f - <<EOF
 apiVersion: v1

product_docs/docs/edb-postgres-ai/1.2/hybrid-manager/install/gcp/prerequisites/gcpcluster.mdx

@@ -251,7 +251,7 @@ Both namespaces and secrets are used in the install process.
 
     ```bash
     PG_CONFOUNDING_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
-    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
     ```
 
 1. Create the required namespaces:

product_docs/docs/edb-postgres-ai/1.3/hybrid-manager/ai-factory/how-to-enable-ai-factory.mdx

@@ -20,7 +20,7 @@ If you ran one of the `-install-secrets.sh` scripts during Hybrid Manager setup,
 If not, generate it manually with the following commands (requires `kubectl` configured for your HM cluster):
 
 ```bash
-FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
 
 kubectl create namespace upm-griptape
 

product_docs/docs/edb-postgres-ai/1.3/hybrid-manager/install/configuration/genai_secret.mdx

@@ -17,7 +17,7 @@ For EKS installations using the `eks-install-secrets.sh` script, you can skip ke
 1.  Create a Fernet key and store it in a variable:
 
     ```shell
-    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
     ```
 
     !!!note

product_docs/docs/edb-postgres-ai/preview/hybrid-manager/ai-factory/how-to-enable-ai-factory.mdx

@@ -20,7 +20,7 @@ If you ran one of the `-install-secrets.sh` scripts during Hybrid Manager setup,
 If not, generate it manually with the following commands (requires `kubectl` configured for your HM cluster):
 
 ```bash
-FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
 
 kubectl create namespace upm-griptape
 

product_docs/docs/edb-postgres-ai/preview/hybrid-manager/install/configuration/genai_secret.mdx

@@ -21,7 +21,7 @@ For EKS installations using the `eks-install-secrets.sh` script, you can skip ke
 1.  Create a Fernet key and store it in a variable:
 
     ```shell
-    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
+    FERNET_KEY=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr '+/' '-_')
     ```
 
     !!!note

product_docs/docs/edb-postgres-ai/preview/hybrid-manager/using_hybrid_manager/upgrading_hm/2025.11_to_2025.12.mdx

@@ -31,7 +31,7 @@ This release introduces new authentication secrets, updates the Data Migration S
 **Before** installing the 2025.12 chart, you must manually create the `dex-fernet-key`.
 
    ```bash
-   FERNET_KEY=$(head -c 32 /dev/urandom | base64)
+   FERNET_KEY=$(head -c 32 /dev/urandom | base64 | tr '+/' '-_')
 
    kubectl create secret generic dex-fernet-key \
      --from-literal=fernet-key="$FERNET_KEY" \