Mount mediafs CephFS into arrstack (#391)

Exposes the legacy mediafs CephFS filesystem to the arrstack namespace so the upcoming mediamover tool can migrate media and run bandwidth tests against the old filesystem; the ceph-mediafs client secret is already seeded in Vault. The mover deployment itself lands in a follow-up PR.

- Adds a `ceph-mediafs-secret` VaultStaticSecret in csi-cephfs syncing `kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret`
- Adds a 10Ti static RWX PV `arrstack-mediafs` (fsName `mediafs`, rootPath `/`, staged with the mediafs secret) pinned by claimRef
- Adds the matching `mediafs` PVC in arrstack (storageClassName "", volumeName-bound, backups excluded)
- Registers all three in their base kustomizations

Reviewed-on: #391
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/csi-cephfs/kustomization.yaml

@@ -6,5 +6,6 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vaultstaticsecret-mediafs.yaml
   - storageclass.yaml
   - vmservicescrape.yaml

apps/base/csi-cephfs/vaultstaticsecret-mediafs.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: ceph-mediafs-secret
+  namespace: csi-cephfs
+spec:
+  vaultAuthRef: ceph-csi-cephfs
+  mount: kv
+  type: kv-v2
+  path: service/kubernetes/au/syd1/csi/ceph-mediafs-secret
+  refreshAfter: 5m
+  destination:
+    name: ceph-mediafs-secret
+    create: true