feat(eso): chart 0.7.0 — migrate all 4 remaining Tower-stamped Secrets to ExternalSecret

Phase 2 of Item #9. Adds ExternalSecret manifests for:
  - docker-mirror-pull (×2 namespaces, dockerconfigjson template)
  - cloudflare-api-token-<slug> (per-tenant, gated on tenant.id+slug)
  - s3-backup-creds (per-tenant, in tenants ns)
  - longhorn-s3-creds (per-tenant, gated on tenant.s3Endpoint)

New helm values: tenant.id, tenant.slug, tenant.s3Endpoint. Tower must
pass these per-cluster (next ship). All manifests gated on
externalSecrets.enabled + mountPath set + tenant.id set, so old apps
without the new params remain on the legacy Tower-stamped path until
the operator opts them in.

templates/s3-backup-creds-externalsecret.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.externalSecrets.enabled }}
+{{- if .Values.externalSecrets.openbao.mountPath }}
+{{- if .Values.tenant.id }}
+# s3-backup-creds — per-tenant S3 backup credentials consumed by the
+# instance-template-v3 backup-cronjob (env: AWS_ACCESS_KEY_ID +
+# AWS_SECRET_ACCESS_KEY). Source: v3/tenants/<id>/s3-credentials in
+# OpenBao with fields access_key + secret_key. Lives in the `tenants`
+# namespace where the per-instance backup CronJobs run.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: s3-backup-creds
+  namespace: tenants
+  labels:
+    app.kubernetes.io/managed-by: cluster-platform-v3
+    odoosky.io/tenant: {{ .Values.tenant.id | quote }}
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: openbao-platform
+    kind: ClusterSecretStore
+  target:
+    name: s3-backup-creds
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      engineVersion: v2
+      data:
+        AWS_ACCESS_KEY_ID: "{{ `{{ .access_key }}` }}"
+        AWS_SECRET_ACCESS_KEY: "{{ `{{ .secret_key }}` }}"
+  data:
+    - secretKey: access_key
+      remoteRef:
+        key: tenants/{{ .Values.tenant.id }}/s3-credentials
+        property: access_key
+    - secretKey: secret_key
+      remoteRef:
+        key: tenants/{{ .Values.tenant.id }}/s3-credentials
+        property: secret_key
+{{- end }}
+{{- end }}
+{{- end }}