Ignore defaulted StatefulSet volumeClaimTemplates TypeMeta (#350)

## Why

Kubernetes defaults `apiVersion: v1` and `kind: PersistentVolumeClaim` onto every StatefulSet `volumeClaimTemplates` entry, but neither the raw manifests nor the rendered helm charts in this repo emit those fields. Live StatefulSets therefore carry TypeMeta that git lacks, and ArgoCD reports a diff that removes it.

`volumeClaimTemplates` are immutable on an existing StatefulSet, so ArgoCD can never apply the removal. The affected StatefulSets stay perpetually OutOfSync and the un-appliable diff can contribute to sync failures.

Rendering the overlays confirms this is a chronic render-vs-live mismatch, not a regression: the source manifests/charts have never emitted the TypeMeta. Affected StatefulSets (render lacks TypeMeta, live defaults it in):

- `consul-server` (consul, helm render)
- `nats` (logging, helm render)
- `kanidm` (kanidm, raw manifest)

`vault` and the `woodpecker` StatefulSets already emit TypeMeta from their charts and are unaffected.

## How

- Add a fleet-wide `resource.customizations.ignoreDifferences.apps_StatefulSet` to the `argocd-cm` patch, using `jqPathExpressions` to ignore the defaulted `apiVersion` and `kind` under every `volumeClaimTemplates` entry.

A single global customization is chosen over per-manifest edits because the affected StatefulSets span both raw manifests (kanidm) and helm renders (consul, nats) whose output cannot be edited; it is inert for StatefulSets that already emit TypeMeta (vault, woodpecker) and future-proof for new ones. The live StatefulSets are left untouched — their `volumeClaimTemplates` are immutable, and recreation would orphan PVCs.

---------

Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #350
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

clusters/au-syd1/bootstrap/argocd-cm-patch.yaml

@@ -6,6 +6,16 @@ metadata:
   namespace: argocd
 data:
   kustomize.buildOptions: "--enable-helm"
+  # Kubernetes defaults apiVersion/kind onto every StatefulSet
+  # volumeClaimTemplates entry, but neither the raw manifests nor the helm
+  # charts emit them, so live StatefulSets carry TypeMeta that git lacks.
+  # volumeClaimTemplates are immutable on an existing StatefulSet, so ArgoCD
+  # can never reconcile the removal and the resource stays perpetually
+  # OutOfSync. Ignore the defaulted TypeMeta fleet-wide.
+  resource.customizations.ignoreDifferences.apps_StatefulSet: |
+    jqPathExpressions:
+      - '.spec.volumeClaimTemplates[]?.apiVersion'
+      - '.spec.volumeClaimTemplates[]?.kind'
   # External URL ArgoCD serves on (TLS terminated at the traefik-internal gateway).
   url: https://argocd.k8s.syd1.au.unkin.net
   # OIDC login via Authentik. The client secret is seeded in Vault out of band