feat(eso): chart 0.6.0 - ESO subchart + ClusterSecretStore + gitea-archive-pull ExternalSecret

Phase 1 of Item #9 (Tower-stamped Secrets → ESO + OpenBao migration).
Replaces Tower's imperative kubectl-stamp of gitea-archive-pull with
a declarative ExternalSecret synced from OpenBao at v3/platform/gitea-
archive-pull. Other 4 Tower-stamped Secrets (cloudflare, s3-backup,
longhorn-s3, docker-mirror-pull) remain on legacy path.

Tower must pass externalSecrets.openbao.mountPath as a per-cluster
helm parameter (kubernetes-<server-name>) for ESO to activate; chart
guards against unset mountPath via {{ if }} in both new templates.

templates/gitea-archive-pull-externalsecret.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+# ExternalSecret — declarative replacement for Tower's imperative
+# kubectl-stamp of `gitea-archive-pull` (server_adapters.go was the
+# previous owner; removed in tower:0.76.20). The K8s Secret produced
+# in odoosky-system has the same name + key shape (`token`) the
+# addon-build init container expects, so consumer code is unchanged.
+#
+# refreshInterval=0 → ESO does NOT poll OpenBao on a schedule. Token
+# rotation is operator-driven: `bao kv put v3/platform/gitea-archive-pull
+# token=NEW_VALUE`, then bump an annotation on this CR to force a
+# resync (`kubectl annotate externalsecret gitea-archive-pull -n
+# odoosky-system rotate=$(date +%s) --overwrite`). Saves audit-log
+# noise for a token that rotates quarterly at most.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: gitea-archive-pull
+  namespace: odoosky-system
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+spec:
+  refreshInterval: "0"
+  secretStoreRef:
+    name: openbao-platform
+    kind: ClusterSecretStore
+  target:
+    name: gitea-archive-pull
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  data:
+    - secretKey: token
+      remoteRef:
+        key: platform/gitea-archive-pull
+        property: token
+{{- end }}
+{{- end }}