Add Airflow and Kafka broker configs to git

- config/airflow/airflow.cfg (fernet/API keys redacted) + live DAG sync
- config/kafka/kraft-server.properties (live KRaft broker on kafka01)
- Extend collect-fleet-config.sh for airflow/kafka collection
- Add docs/recommendations.md with prioritized next steps

config/airflow/airflow.cfg

@@ -169,7 +169,7 @@ execute_tasks_new_python_interpreter = False
 #
 # Variable: AIRFLOW__CORE__FERNET_KEY
 #
-fernet_key = f4n7uT66HPrl8yxqKHVtme_qINN9YlZ1xUQcZy761MY=
+fernet_key = REDACTED
 
 # Whether to disable pickling dags
 #
@@ -445,7 +445,7 @@ database_access_isolation = False
 #
 # Variable: AIRFLOW__CORE__INTERNAL_API_SECRET_KEY
 #
-internal_api_secret_key = 010RL08807/JBjH4cWzNaw==
+internal_api_secret_key = REDACTED
 
 # The ability to allow testing connections across Airflow UI, API and CLI.
 # Supported options: ``Disabled``, ``Enabled``, ``Hidden``. Default: Disabled
@@ -1193,7 +1193,7 @@ enable_swagger_ui = True
 #
 # Variable: AIRFLOW__API__SECRET_KEY
 #
-secret_key = 010RL08807/JBjH4cWzNaw==
+secret_key = REDACTED
 
 # Expose the configuration file in the web server. Set to ``non-sensitive-only`` to show all values
 # except those that have security implications. ``True`` shows all values. ``False`` hides the