Deploy k8up backup operator (platform, k8up-system) (#363)

The k8up CRDs already exist in the cluster (owned by a separate `k8up-crds` Helm release) but the k8up operator itself was never deployed, so no k8up backup/restore custom resources are reconciled. This installs the operator following the cnpg-system pattern (Helm inflated via kustomize `helmCharts`) in the `platform` ArgoCD project, namespace `k8up-system`.

- Add `apps/base/k8up-system/` (Namespace + kustomization).
- Add `apps/overlays/au-syd1/k8up-system/` inflating the **k8up chart `4.10.0`** (pinned) from the artifactapi virtual-helm proxy: `replicaCount: 2` (leader election with hot-standby follower), operator resource requests/limits (20m/128Mi req, 500m/256Mi lim), and ServiceMonitor/PrometheusRule disabled (require Prometheus Operator CRDs).
- Add a `PodDisruptionBudget` (`minAvailable: 1`) in the overlay, since the k8up chart exposes no native PDB value.
- Register `apps/overlays/*/k8up-system` in the platform ApplicationSet.

**CRD management:** The k8up chart ships its CRDs via the Helm `crds/` directory (there is no `installCRDs`/`skipCrds`/`enableCRDCreation` value). The kustomize helm inflator does not emit `crds/`, so `kustomize build` renders only the operator (Deployment, RBAC, SA, Service) and no CRDs. ArgoCD therefore does not fight the existing `k8up-crds` Helm release over CRD ownership.

**platform.yaml (AppProject):** no change needed. The virtual-helm sourceRepo, the `*-system` destination, and the ClusterRole/ClusterRoleBinding/CRD/webhook clusterResourceWhitelist entries are already present and cover everything this app renders.

**Validation:** `kustomize build --enable-helm apps/overlays/au-syd1/k8up-system` succeeds (Deployment replicas 2, PDB, Namespace, RBAC; 0 CRDs). `make kubeconform` reports k8up-system 14/14 valid; the only failure is the pre-existing, unrelated `cattle-system` rancher chart kubeVersion issue. pre-commit passes.

Reviewed-on: #363
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/k8up-system/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml

apps/base/k8up-system/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: k8up-system

apps/overlays/au-syd1/k8up-system/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../../../base/k8up-system
+  - poddisruptionbudget.yaml
+
+helmCharts:
+  - name: k8up
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "4.10.0"
+    releaseName: k8up
+    namespace: k8up-system
+    valuesFile: values.yaml

apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: k8up
+  namespace: k8up-system
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: k8up
+      app.kubernetes.io/instance: k8up

apps/overlays/au-syd1/k8up-system/values.yaml

@@ -0,0 +1,18 @@
+# CRDs are managed by the separate `k8up-crds` Helm release already present in
+# the cluster; the k8up chart ships CRDs via its crds/ directory, which the
+# kustomize helm inflator does not emit, so ArgoCD does not fight CRD ownership.
+replicaCount: 2
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 256Mi
+  requests:
+    cpu: 20m
+    memory: 128Mi
+
+metrics:
+  serviceMonitor:
+    enabled: false # Requires Prometheus Operator CRDs.
+  prometheusRule:
+    enabled: false # Requires Prometheus Operator CRDs.

argocd/applicationsets/platform.yaml

@@ -31,6 +31,7 @@ spec:
       - path: apps/overlays/*/grafana-system
       - path: apps/overlays/*/inteldeviceplugins-system
       - path: apps/overlays/*/jfrog
+      - path: apps/overlays/*/k8up-system
       - path: apps/overlays/*/kanidm
       - path: apps/overlays/*/netbox
       - path: apps/overlays/*/node-feature-discovery