feat(eso): chart 0.6.0 - ESO subchart + ClusterSecretStore + gitea-archive-pull ExternalSecret

Phase 1 of Item #9 (Tower-stamped Secrets → ESO + OpenBao migration).
Replaces Tower's imperative kubectl-stamp of gitea-archive-pull with
a declarative ExternalSecret synced from OpenBao at v3/platform/gitea-
archive-pull. Other 4 Tower-stamped Secrets (cloudflare, s3-backup,
longhorn-s3, docker-mirror-pull) remain on legacy path.

Tower must pass externalSecrets.openbao.mountPath as a per-cluster
helm parameter (kubernetes-<server-name>) for ESO to activate; chart
guards against unset mountPath via {{ if }} in both new templates.

templates/gitea-archive-pull-externalsecret.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+# ExternalSecret — declarative replacement for Tower's imperative
+# kubectl-stamp of `gitea-archive-pull` (server_adapters.go was the
+# previous owner; removed in tower:0.76.20). The K8s Secret produced
+# in odoosky-system has the same name + key shape (`token`) the
+# addon-build init container expects, so consumer code is unchanged.
+#
+# refreshInterval=0 → ESO does NOT poll OpenBao on a schedule. Token
+# rotation is operator-driven: `bao kv put v3/platform/gitea-archive-pull
+# token=NEW_VALUE`, then bump an annotation on this CR to force a
+# resync (`kubectl annotate externalsecret gitea-archive-pull -n
+# odoosky-system rotate=$(date +%s) --overwrite`). Saves audit-log
+# noise for a token that rotates quarterly at most.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: gitea-archive-pull
+  namespace: odoosky-system
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+spec:
+  refreshInterval: "0"
+  secretStoreRef:
+    name: openbao-platform
+    kind: ClusterSecretStore
+  target:
+    name: gitea-archive-pull
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: platform/gitea-archive-pull
+        property: token
+{{- end }}
+{{- end }}

templates/openbao-secretstore.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+# ClusterSecretStore — single store per cluster, namespace-spanning so a
+# tenants-namespace ExternalSecret can also reference it (current Phase 1
+# scope only writes to odoosky-system, but downstream phases will fan to
+# tenants ns for s3-backup-creds).
+#
+# auth.kubernetes.mountPath is per-cluster (Tower passes
+# `kubernetes-<cluster-name>` as a helm parameter). Each cluster
+# authenticates against its own OpenBao auth mount, with the
+# `eso-platform-read` policy bound to the role. ServiceAccount
+# `external-secrets` is created by the ESO subchart in odoosky-system.
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-platform
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+spec:
+  provider:
+    vault:
+      server: {{ .Values.externalSecrets.openbao.server | quote }}
+      path: "v3"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: {{ .Values.externalSecrets.openbao.mountPath | quote }}
+          role: {{ .Values.externalSecrets.openbao.role | default "eso" | quote }}
+          serviceAccountRef:
+            name: external-secrets
+            namespace: odoosky-system
+{{- end }}
+{{- end }}