Replace vector-archiver with logarchiver (#308)

## Why

The Vector archiver leg wrote gzip NDJSON to S3 with no index or encryption. logarchiver replaces it with a Go service that seals raw logs to S3 as zstd + OpenPGP objects and indexes each object in ClickHouse (`logs.archive_index`), acking JetStream only after the object is stored and indexed.

## Changes

- Add logarchiver Deployment (`git.unkin.net/unkin/logarchiver:v0.1.0`), ConfigMap, and dedicated ServiceAccount, reusing the archiver's NATS (`log-consumer` / durable `archiver` / `ARCHIVE_SUBJECTS=logs.k8s.vault.>`), S3 (`logs-archive-s3`), ClickHouse (`clickhouse-credentials`) and `vault-ca` wiring.
- Encrypts to the `logarchive` gpg public key, fetched from the gpg engine via k8s auth (role `logging_logarchiver`, projected vault-audience token). `ack_wait` (5m) > batch `max_age` (2m) so messages aren't redelivered mid-batch.
- Add `logs.archive_index` DDL to the clickhouse-schema bootstrap Job (no TTL — outlives `logs.raw`).
- Remove the vector-archiver Helm release, values and pipeline ConfigMap.

Cross-repo: apply **terraform-vault #106** (gpg key + role/policy) before this syncs, or the pod can't fetch the public key. Sequencing: apply after #306 (already merged).

https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---------

Co-authored-by: benvin <neotheo@gmail.com>
Reviewed-on: #308
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/overlays/au-syd1/logging/kustomization.yaml

@@ -36,10 +36,4 @@ helmCharts:
     releaseName: vector-aggregator
     namespace: logging
     valuesFile: values-vector-aggregator.yaml
-  # Archiver (Deployment): independent JetStream consumer -> raw logs to S3.
-  - name: vector
-    repo: https://helm.vector.dev
-    version: "0.57.0"
-    releaseName: vector-archiver
-    namespace: logging
-    valuesFile: values-vector-archiver.yaml
+  # Archiver: replaced by the logarchiver Deployment (apps/base/logging).

apps/overlays/au-syd1/logging/values-vector-archiver.yaml

@@ -1,59 +0,0 @@
-# Vector ARCHIVER tier (Deployment) — independent JetStream consumer writing raw
-# logs to S3 (Ceph RGW). Isolated from the ClickHouse path (own durable
-# consumer). Pipeline: apps/base/logging/vector/archiver.yaml.
-role: Stateless-Aggregator
-fullnameOverride: vector-archiver
-replicas: 1
-
-image:
-  repository: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector
-  tag: 0.57.0-distroless-libc
-
-workloadResourceAnnotations:
-  reloader.stakater.com/auto: "true"
-
-podLabels:
-  vector.dev/exclude: "true"
-
-dataDir: /vector-data-dir
-existingConfigMaps:
-  - vector-archiver-config
-
-env:
-  # Vector 0.57 disables ${VAR} config interpolation by default; auth needs it.
-  - name: VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION
-    value: "true"
-  - name: NATS_CONSUMER_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: nats-auth
-        key: consumer_password
-
-# S3 creds (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) from the cephrgw-operator
-# BucketAccess Secret.
-envFrom:
-  - secretRef:
-      name: logs-archive-s3
-
-# Trust the internal unkin.net Vault-PKI CA to verify s3.ceph.unkin.net.
-# vault-ca-cert is reflected into every namespace from the certificates ns.
-extraVolumes:
-  - name: vault-ca-cert
-    secret:
-      secretName: vault-ca-cert
-extraVolumeMounts:
-  - name: vault-ca-cert
-    mountPath: /etc/vault-ca/ca.crt
-    subPath: ca.crt
-    readOnly: true
-
-service:
-  enabled: false
-
-resources:
-  requests:
-    cpu: 100m
-    memory: 256Mi
-  limits:
-    cpu: "1"
-    memory: 1Gi