Deploy arrproxy v0.2.0 machine-mint admin route

Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can
machine-mint arrproxy tokens through the ingress.

- Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth
  default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token
- Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the
  Reloader reload annotation so the pod rolls on rotation
- Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by
  arrproxy's own token); /api/tokens and /api/me stay oauth-gated
- Bump arrproxy-api and arrproxy-ui images to v0.2.0

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -31,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080