mediamark: deploy the media marking app (#441)

## Why

mediamark needs a home in the cluster: it marks/organises media on the shared mediastore tree and drives the adult-tier sonarr/radarr through arrproxy's hash routes. This adds the full app to the `media` project, mirroring the watchstate two-host oauth2-proxy pattern and the arrstack static-CephFS + projected-API-keys patterns.

## How

- Adds `apps/base/mediamark/`: namespace, VaultAuth (`k8s/au/syd1`, role `default`), three VaultStaticSecrets, static mediastore PV/PVC, the app Deployment, oauth2-proxy ConfigMap/Deployment, two Services, and internal + external Gateway/HTTPRoute pairs.
- Binds a dedicated static PV (`mediamark-mediastore`, own `volumeHandle`, `claimRef`-pinned) to the same CephFS mediastore subvolume arrstack/fafflix/cheeztv use, RWX 10Ti Retain, mounted at `/media`.
- Runs the app as 1000:1000 (deliberately not 65532) so it owns files on the shared media tree and hardlink/rename moves stay valid; read-only root filesystem, all caps dropped, no service-account token, `/livez` + `/readyz` probes.
- Projects the sonarr/radarr API keys as one file per app under `/etc/mediamark/keys`, mirroring arrproxy's keys projection, with reloader annotations on both secrets.
- Fronts both `mediamark.unkin.net` (traefik-external, reflected Let's Encrypt wildcard, no cert-manager annotations) and `mediamark.k8s.syd1.au.unkin.net` (traefik-internal, vault-issuer) with a single oauth2-proxy using a relative `/oauth2/callback` redirect; gated on `akP-mediamark-user` and passing identity to the app as `X-Forwarded-Groups` via `PASS_USER_HEADERS`.
- Appends `mediamark` to the `wildcard-unkin-net` Certificate's two reflector namespace lists, and registers the app in `argocd/applicationsets/media.yaml` + `argocd/projects/media.yaml` with a passthrough `apps/overlays/au-syd1/mediamark` overlay.

## Prerequisite seeds (Ben, before pods go Ready)

These KV paths must exist under `kv/kubernetes/namespace/mediamark/default/` — the `mediamark/default` templated policy already grants read, so no terraform-vault change is needed:

- `oauth-credentials` — needs `client_id` and `cookie_secret` added alongside the existing `client_secret` (Authentik mediamark provider; both absolute callback URIs registered there).
- `sonarr` — key `apitoken`.
- `radarr` — key `apitoken`.

## Validation

- `kustomize build --enable-helm apps/overlays/au-syd1/mediamark` (18 resources) and `.../cert-manager` both build.
- kubeconform clean on both touched overlays.
- `pre-commit run --all-files` passes.

Reviewed-on: #441
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/mediamark/deployment.yaml

@@ -0,0 +1,114 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mediamark
+  namespace: mediamark
+  annotations:
+    secret.reloader.stakater.com/reload: "arrstack-virtual-key"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mediamark
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mediamark
+    spec:
+      serviceAccountName: default
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        # 1000:1000 matches the media tree ownership on the shared mediastore
+        # subvolume; mediamark hardlinks/renames files the *arr apps own, so it
+        # deliberately does NOT run as the usual 65532.
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: mediamark
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            - name: MEDIAMARK_MEDIA_ROOT
+              value: /media
+            - name: MEDIAMARK_KEYS_DIR
+              value: /etc/mediamark/keys
+            # Virtual keys are only honoured by arrproxy, which validates the
+            # machine token and injects the real per-app key upstream; the
+            # sonarr/radarr Services would reject them.
+            - name: MEDIAMARK_SONARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/sonarr
+            - name: MEDIAMARK_RADARR_URL
+              value: http://arrproxy-api.arrstack.svc.cluster.local:8080/3aa168/radarr
+            # oauth2-proxy --pass-user-headers forwards the Authentik groups as a
+            # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
+            # auth_request-response-only and never reaches a proxied upstream.
+            - name: MEDIAMARK_GROUPS_HEADER
+              value: X-Forwarded-Groups
+            - name: MEDIAMARK_ALLOWED_GROUPS
+              value: akP-mediamark-user
+          volumeMounts:
+            - name: mediastore
+              mountPath: /media
+            - name: arr-keys
+              mountPath: /etc/mediamark/keys
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: mediastore
+          persistentVolumeClaim:
+            claimName: mediamark-mediastore
+        # One ephemeral virtual key covers both apps, so the same token lands on
+        # both per-app files under MEDIAMARK_KEYS_DIR; mediamark re-reads the
+        # file per request, so lease renewal rotates in place.
+        - name: arr-keys
+          projected:
+            sources:
+              - secret:
+                  name: arrstack-virtual-key
+                  items:
+                    - key: token
+                      path: sonarr
+                    - key: token
+                      path: radarr
+      restartPolicy: Always