Add advise-mode VerticalPodAutoscaler for every workload

Adds a VerticalPodAutoscaler (updateMode: Off, recommendation-only) targeting
every Deployment and StatefulSet across apps/base. Off mode never mutates pods,
so this only gathers right-sizing recommendations. CNPG Clusters and CronJobs
are not VPA targets and are skipped.

apps/base/authentik/kustomization.yaml

@@ -17,3 +17,4 @@ resources:
   - redis-service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vpa.yaml

apps/base/authentik/vpa.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: redis-vpa
+  namespace: authentik
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: redis
+  updatePolicy:
+    updateMode: "Off"