feat(eso): chart 0.7.0 — migrate all 4 remaining Tower-stamped Secrets to ExternalSecret

Phase 2 of Item #9. Adds ExternalSecret manifests for:
  - docker-mirror-pull (×2 namespaces, dockerconfigjson template)
  - cloudflare-api-token-<slug> (per-tenant, gated on tenant.id+slug)
  - s3-backup-creds (per-tenant, in tenants ns)
  - longhorn-s3-creds (per-tenant, gated on tenant.s3Endpoint)

New helm values: tenant.id, tenant.slug, tenant.s3Endpoint. Tower must
pass these per-cluster (next ship). All manifests gated on
externalSecrets.enabled + mountPath set + tenant.id set, so old apps
without the new params remain on the legacy Tower-stamped path until
the operator opts them in.

templates/docker-mirror-pull-externalsecret.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+# docker-mirror-pull — platform-wide registry credential. Two ExternalSecrets
+# (one per namespace the chart consumes the Secret in) sourced from the same
+# OpenBao path. Type kubernetes.io/dockerconfigjson rendered via ESO template
+# from the registry/username/password fields stored in OpenBao.
+{{- range $ns := list "odoosky-system" "tenants" }}
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: docker-mirror-pull
+  namespace: {{ $ns }}
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: openbao-platform
+    kind: ClusterSecretStore
+  target:
+    name: docker-mirror-pull
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      type: kubernetes.io/dockerconfigjson
+      engineVersion: v2
+      data:
+        .dockerconfigjson: |
+          {{ `{"auths":{"{{ .registry }}":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}` }}
+  data:
+    - secretKey: registry
+      remoteRef:
+        key: platform/docker-mirror-pull
+        property: registry
+    - secretKey: username
+      remoteRef:
+        key: platform/docker-mirror-pull
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: platform/docker-mirror-pull
+        property: password
+{{- end }}
+{{- end }}
+{{- end }}