feat(eso): chart 0.6.0 - ESO subchart + ClusterSecretStore + gitea-archive-pull ExternalSecret

Phase 1 of Item #9 (Tower-stamped Secrets → ESO + OpenBao migration).
Replaces Tower's imperative kubectl-stamp of gitea-archive-pull with
a declarative ExternalSecret synced from OpenBao at v3/platform/gitea-
archive-pull. Other 4 Tower-stamped Secrets (cloudflare, s3-backup,
longhorn-s3, docker-mirror-pull) remain on legacy path.

Tower must pass externalSecrets.openbao.mountPath as a per-cluster
helm parameter (kubernetes-<server-name>) for ESO to activate; chart
guards against unset mountPath via {{ if }} in both new templates.

Chart.lock

@@ -0,0 +1,15 @@
+dependencies:
+- name: cert-manager
+  repository: https://charts.jetstack.io
+  version: v1.16.1
+- name: traefik
+  repository: https://traefik.github.io/charts
+  version: 33.2.1
+- name: longhorn
+  repository: https://charts.longhorn.io
+  version: 1.7.2
+- name: external-secrets
+  repository: https://charts.external-secrets.io
+  version: 0.10.7
+digest: sha256:7b35cac211af5d24103b3d1f94be2c1bbf9c6ce29574674d454d3060482e48ee
+generated: "2026-05-07T20:39:30.022767+03:00"