Deploy arrproxy v0.2.0 machine-mint admin route (#384)

## Why

The future Vault engine needs to machine-mint arrproxy tokens without an interactive Authentik session. arrproxy v0.2.0 adds an admin route (`POST /api/admin/...`) protected by its own bearer token; OpenBao running on the VMs calls it through the arrstack ingress. This deploys that route.

## Changes

- Add an `arrproxy-admin-token` VaultStaticSecret (mirrors the `arrproxy-pepper` VSO: same `default` VaultAuth, k8s-auth default-SA pattern) syncing `kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token` into the `arrproxy-admin-token` Secret. The token is seeded in Vault KV as the shared source of truth for the future Vault engine.
- Set `ARRPROXY_ADMIN_TOKEN` on the arrproxy-api Deployment via `secretKeyRef` (key `token`), and add `arrproxy-admin-token` to the Reloader `secret.reloader.stakater.com/reload` annotation so the pod rolls on rotation.
- Skip-auth the `/api/admin/` route in oauth2-proxy: `OAUTH2_PROXY_SKIP_AUTH_REGEX` becomes `^/[^/]+/api,^/api/admin/`. The admin route is intentionally oauth-skipped because it is protected by arrproxy's OWN bearer token so OpenBao can reach it machine-to-machine. `/api/tokens` and `/api/me` are NOT matched and stay oauth-gated. `/api/admin/*` already routes to the arrproxy-api upstream via the existing catch-all `/api/` upstream, so no upstream change is needed.
- Bump arrproxy-api and arrproxy-ui images to `v0.2.0` (kept in lockstep).

## Validation

- `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` succeeds.
- pre-commit passes, including the plain-Secret guard (only the VSO CRD is used; no plain Secret objects added).

Reviewed-on: #384
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     # Wave 2: serve only after the wave-1 migrate Job completes.
     argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
 spec:
   replicas: 2
   selector:
@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -59,6 +59,15 @@ spec:
                 secretKeyRef:
                   name: arrproxy-pepper
                   key: pepper
+            # Machine-mint admin bearer, synced from Vault KV via the
+            # arrproxy-admin-token VSO. Gates the /api/admin/ route that
+            # oauth2-proxy intentionally skip-auths so OpenBao on the VMs can
+            # mint tokens against arrproxy's own bearer.
+            - name: ARRPROXY_ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-admin-token
+                  key: token
             # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
             # $(VAR) expansion resolves the two env entries defined above it.
             - name: ARRPROXY_DB_USER