watchstate: deploy admin-gated jellyfin watch-state sync tool

Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app,
fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern.

- ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors
  route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete
  RWO PVC at /config (sqlite + in-container cron/redis are single-writer).
- oauth2-proxy fronts every path; Authentik OIDC issuer
  identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side
  (akR-global-admin only), so no oauth2-proxy group allowlist.
- Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net,
  vault-issuer TLS leaf, external-dns to 198.18.200.4.
- VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects.
- Registered in the media ApplicationSet + AppProject.

No VMPodScrape: WatchState exposes no /metrics endpoint.

argocd/applicationsets/media.yaml

@@ -13,6 +13,7 @@ spec:
       - path: apps/overlays/*/fafflix
       - path: apps/overlays/*/cheeztv
       - path: apps/overlays/*/arrstack
+      - path: apps/overlays/*/watchstate
   template:
     metadata:
       name: 'media-{{path[3]}}'

argocd/projects/media.yaml

@@ -15,6 +15,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'arrstack'
       server: https://kubernetes.default.svc
+    - namespace: 'watchstate'
+      server: https://kubernetes.default.svc
   clusterResourceWhitelist:
     - group: ''
       kind: Namespace