watchstate: deploy admin-gated jellyfin watch-state sync tool

Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app,
fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern.

- ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors
  route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete
  RWO PVC at /config (sqlite + in-container cron/redis are single-writer).
- oauth2-proxy fronts every path; Authentik OIDC issuer
  identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side
  (akR-global-admin only), so no oauth2-proxy group allowlist.
- Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net,
  vault-issuer TLS leaf, external-dns to 198.18.200.4.
- VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects.
- Registered in the media ApplicationSet + AppProject.

No VMPodScrape: WatchState exposes no /metrics endpoint.

apps/base/watchstate/httproute.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: watchstate-http-redirect
+  namespace: watchstate
+spec:
+  hostnames:
+    - watchstate.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: watchstate
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: watchstate
+  namespace: watchstate
+spec:
+  hostnames:
+    - watchstate.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: watchstate
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: watchstate-oauth2
+          port: 80
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /