feat(eso): chart 0.6.0 - ESO subchart + ClusterSecretStore + gitea-archive-pull ExternalSecret

Phase 1 of Item #9 (Tower-stamped Secrets → ESO + OpenBao migration).
Replaces Tower's imperative kubectl-stamp of gitea-archive-pull with
a declarative ExternalSecret synced from OpenBao at v3/platform/gitea-
archive-pull. Other 4 Tower-stamped Secrets (cloudflare, s3-backup,
longhorn-s3, docker-mirror-pull) remain on legacy path.

Tower must pass externalSecrets.openbao.mountPath as a per-cluster
helm parameter (kubernetes-<server-name>) for ESO to activate; chart
guards against unset mountPath via {{ if }} in both new templates.

templates/openbao-secretstore.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+# ClusterSecretStore — single store per cluster, namespace-spanning so a
+# tenants-namespace ExternalSecret can also reference it (current Phase 1
+# scope only writes to odoosky-system, but downstream phases will fan to
+# tenants ns for s3-backup-creds).
+#
+# auth.kubernetes.mountPath is per-cluster (Tower passes
+# `kubernetes-<cluster-name>` as a helm parameter). Each cluster
+# authenticates against its own OpenBao auth mount, with the
+# `eso-platform-read` policy bound to the role. ServiceAccount
+# `external-secrets` is created by the ESO subchart in odoosky-system.
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-platform
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+spec:
+  provider:
+    vault:
+      server: {{ .Values.externalSecrets.openbao.server | quote }}
+      path: "v3"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: {{ .Values.externalSecrets.openbao.mountPath | quote }}
+          role: {{ .Values.externalSecrets.openbao.role | default "eso" | quote }}
+          serviceAccountRef:
+            name: external-secrets
+            namespace: odoosky-system
+{{- end }}
+{{- end }}