arrstack: manage sonarr/radarr/prowlarr API keys via Vault

Vault is the source of truth for the sonarr/radarr/prowlarr API keys
(override bootstrap): keys are minted in Vault and enforced into each
app's /config/config.xml on startup, replacing the images'
self-generated keys.

- add a VaultAuth 'default' in the arrstack namespace (k8s auth, mount
  k8s/au/syd1, role default, SA default) mirroring the jellyfin pattern
- add a per-app VaultStaticSecret syncing
  kv/kubernetes/namespace/arrstack/default/<app> (key apitoken) into the
  <app>-apikey Secret; the default k8s role's templated policy already
  grants read there, so no terraform-vault change is needed
- add an apikey-init initContainer to each deployment that fails closed
  on a missing/non-hex key and writes/updates only the <ApiKey> element
  in /config/config.xml (busybox via artifactapi, runs as root)
- wire the new manifests into the base and per-app kustomizations

nzbget is out of scope (no config.xml <ApiKey>; uses ControlPassword).

apps/base/arrstack/vaultauth.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  allowedNamespaces:
+    - arrstack
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default