Deploy kea DHCP operator to dhcp-system

Replaces the isc-dhcpd PXE-boot VM with the kea-operator (v0.1.0) and an
HA kea pair, managed by ArgoCD. Deploys on a new, unused anycast IP; the
production cutover off the current dhcpd address is a separate later task.

- Add apps/base/dhcp-system: namespace, kea-operator RBAC + Deployment,
  VPA, and the kea.unkin.net CRDs pulled from the operator repo at v0.1.0.
- Add the CRs translating the legacy dhcpd config: KeaCluster (2 replicas,
  hot-standby HA, main.unkin.net, 1200/86400 leases, AU ntp pool), five
  KeaSubnets 198.18.13-17.0/24 (gateways .254 except .17->.1 per the puppet
  dhcp hieradata), Legacy/UEFI-64 PXE client classes, and the KeaAPI.
- Pin the DHCP LoadBalancer Service to the free common-pool IP 198.18.200.10
  via PureLB (not the current dhcpd anycast 198.18.19.18).
- Provision the KeaAPI bearer token via an operator-generated Secret.
- Commit generated kea.unkin.net JSON schemas for kubeconform.
- Register dhcp-system in the platform ApplicationSet and AppProject.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

argocd/applicationsets/platform.yaml

@@ -22,6 +22,7 @@ spec:
       - path: apps/overlays/*/cephrgw-system
       - path: apps/overlays/*/cnpg-system
       - path: apps/overlays/*/consul
+      - path: apps/overlays/*/dhcp-system
       - path: apps/overlays/*/elastic-system
       - path: apps/overlays/*/encapi
       - path: apps/overlays/*/externaldns

argocd/projects/platform.yaml

@@ -33,6 +33,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'consul'
       server: https://kubernetes.default.svc
+    - namespace: 'dhcp-system'
+      server: https://kubernetes.default.svc
     - namespace: 'encapi'
       server: https://kubernetes.default.svc
     - namespace: 'externaldns'