Deploy arrproxy v0.2.0 machine-mint admin route

Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can
machine-mint arrproxy tokens through the ingress.

- Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth
  default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token
- Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the
  Reloader reload annotation so the pod rolls on rotation
- Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by
  arrproxy's own token); /api/tokens and /api/me stay oauth-gated
- Bump arrproxy-api and arrproxy-ui images to v0.2.0

apps/base/arrstack/arrproxy/vaultstaticsecret.yaml

@@ -25,6 +25,33 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
+# Machine-mint admin bearer token. Seeded (openssl rand) at
+# kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token (key: token) and
+# shared as the source of truth with the future Vault engine. The default k8s
+# role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the arrproxy-admin-token Secret consumed by arrproxy-api as
+# ARRPROXY_ADMIN_TOKEN to gate the bearer-protected /api/admin/ route.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: arrproxy-admin-token
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: arrproxy-admin-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/arrproxy-admin-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
 # Authentik OIDC client for the arrstack front door (client_id, client_secret,
 # cookie_secret), created by terraform-authentik at
 # kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into