deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)

- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore

k8s/externalsecret-registry.yaml

@@ -0,0 +1,26 @@
+# Materializes a docker-registry pull secret (gitea-registry) from OpenBao via the existing
+# ClusterSecretStore, so the private Gitea package can be pulled by k3s without a static secret
+# in Git. Store a read:package Gitea PAT in OpenBao at `cluster/bluecap-registry` with fields
+# `username` (e.g. bmr_bluecap) and `password` (the token).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-registry
+  namespace: bluecap-strategies
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao-cluster
+    kind: ClusterSecretStore
+  target:
+    name: gitea-registry
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"git.7tl-homelab.com":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef: { key: bluecap-registry, property: username }
+    - secretKey: password
+      remoteRef: { key: bluecap-registry, property: password }