Deploy arrproxy v0.2.0 machine-mint admin route

Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can
machine-mint arrproxy tokens through the ingress.

- Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth
  default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token
- Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the
  Reloader reload annotation so the pod rolls on rotation
- Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by
  arrproxy's own token); /api/tokens and /api/me stay oauth-gated
- Bump arrproxy-api and arrproxy-ui images to v0.2.0

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     # Wave 2: serve only after the wave-1 migrate Job completes.
     argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
 spec:
   replicas: 2
   selector:
@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -59,6 +59,15 @@ spec:
                 secretKeyRef:
                   name: arrproxy-pepper
                   key: pepper
+            # Machine-mint admin bearer, synced from Vault KV via the
+            # arrproxy-admin-token VSO. Gates the /api/admin/ route that
+            # oauth2-proxy intentionally skip-auths so OpenBao on the VMs can
+            # mint tokens against arrproxy's own bearer.
+            - name: ARRPROXY_ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-admin-token
+                  key: token
             # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
             # $(VAR) expansion resolves the two env entries defined above it.
             - name: ARRPROXY_DB_USER