jellyfin: add cephrgw config-backup bucket for k8up

Give the jellyfin backup user a second bucket so k8up can store restic
backups of the jellyfin-config PVC alongside the existing CNPG barman
bucket (one user, two buckets).

- Add a jellyfin-config-backup Bucket owned by the existing
  cnpg-jellyfin-backup ObjectStoreUser
- Add a read-write BucketAccess emitting jellyfin-config-backup-s3 with
  the S3 creds k8up consumes
- Wire the new file into the jellyfin kustomization

apps/base/jellyfin/cephrgw-config-backup.yaml

@@ -0,0 +1,32 @@
+---
+# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
+# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
+# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
+# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
+# Secret the k8up Schedule consumes.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: jellyfin-config-backup
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: config-backup
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  bucketRef: jellyfin-config-backup
+  level: read-write
+  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
+  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
+  secretName: jellyfin-config-backup-s3

apps/base/jellyfin/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - cnpg_backup.yaml
+  - cephrgw-config-backup.yaml
   - pvc-config.yaml
   - pvc-transcode.yaml
   - pvc-media-tv.yaml