jellyfin: back up the config PVC with a k8up Schedule

Protect the jellyfin-config PVC (library metadata, plugins, config XML)
with daily restic backups to the new Ceph RGW config-backup bucket.

- Add a k8up.io Schedule: daily backup (02:00), weekly prune (Sun 03:00,
  keep 14 daily/8 weekly/12 monthly) and weekly check (Sun 04:00)
- Source S3 creds from the cephrgw BucketAccess Secret and the restic
  repo password from Vault via a VaultStaticSecret (kv path
  kubernetes/namespace/jellyfin/default/k8up-restic)
- Add the namespace VaultAuth (default role/SA) VSO needs to sync it
- Mount the reflected vault-ca-cert into the restic pods so restic trusts
  the internal unkin.net CA on s3.ceph.unkin.net
- Wire the new files into the jellyfin kustomization

apps/base/jellyfin/kustomization.yaml

@@ -8,6 +8,9 @@ resources:
   - cnpg_pooler.yaml
   - cnpg_backup.yaml
   - cephrgw-config-backup.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - schedule.yaml
   - pvc-config.yaml
   - pvc-transcode.yaml
   - pvc-media-tv.yaml