arrstack: manage sonarr/radarr/prowlarr API keys via Vault

Vault is the source of truth for the sonarr/radarr/prowlarr API keys
(override bootstrap): keys are minted in Vault and enforced into each
app's /config/config.xml on startup, replacing the images'
self-generated keys.

- add a VaultAuth 'default' in the arrstack namespace (k8s auth, mount
  k8s/au/syd1, role default, SA default) mirroring the jellyfin pattern
- add a per-app VaultStaticSecret syncing
  kv/kubernetes/namespace/arrstack/default/<app> (key apitoken) into the
  <app>-apikey Secret; the default k8s role's templated policy already
  grants read there, so no terraform-vault change is needed
- add an apikey-init initContainer to each deployment that fails closed
  on a missing/non-hex key and writes/updates only the <ApiKey> element
  in /config/config.xml (busybox via artifactapi, runs as root)
- wire the new manifests into the base and per-app kustomizations

nzbget is out of scope (no config.xml <ApiKey>; uses ControlPassword).

apps/base/arrstack/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
+  - vaultauth.yaml
   - pv-media-tv.yaml
   - pv-media-movies.yaml
   - pvc-media-tv.yaml