Deploy arrproxy v0.2.0 machine-mint admin route (#384)

## Why

The future Vault engine needs to machine-mint arrproxy tokens without an interactive Authentik session. arrproxy v0.2.0 adds an admin route (`POST /api/admin/...`) protected by its own bearer token; OpenBao running on the VMs calls it through the arrstack ingress. This deploys that route.

## Changes

- Add an `arrproxy-admin-token` VaultStaticSecret (mirrors the `arrproxy-pepper` VSO: same `default` VaultAuth, k8s-auth default-SA pattern) syncing `kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token` into the `arrproxy-admin-token` Secret. The token is seeded in Vault KV as the shared source of truth for the future Vault engine.
- Set `ARRPROXY_ADMIN_TOKEN` on the arrproxy-api Deployment via `secretKeyRef` (key `token`), and add `arrproxy-admin-token` to the Reloader `secret.reloader.stakater.com/reload` annotation so the pod rolls on rotation.
- Skip-auth the `/api/admin/` route in oauth2-proxy: `OAUTH2_PROXY_SKIP_AUTH_REGEX` becomes `^/[^/]+/api,^/api/admin/`. The admin route is intentionally oauth-skipped because it is protected by arrproxy's OWN bearer token so OpenBao can reach it machine-to-machine. `/api/tokens` and `/api/me` are NOT matched and stay oauth-gated. `/api/admin/*` already routes to the arrproxy-api upstream via the existing catch-all `/api/` upstream, so no upstream change is needed.
- Bump arrproxy-api and arrproxy-ui images to `v0.2.0` (kept in lockstep).

## Validation

- `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` succeeds.
- pre-commit passes, including the plain-Secret guard (only the VSO CRD is used; no plain Secret objects added).

Reviewed-on: #384
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     # Wave 2: serve only after the wave-1 migrate Job completes.
     argocd.argoproj.io/sync-wave: "2"
-    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
+    secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-admin-token,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
 spec:
   replicas: 2
   selector:
@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -59,6 +59,15 @@ spec:
                 secretKeyRef:
                   name: arrproxy-pepper
                   key: pepper
+            # Machine-mint admin bearer, synced from Vault KV via the
+            # arrproxy-admin-token VSO. Gates the /api/admin/ route that
+            # oauth2-proxy intentionally skip-auths so OpenBao on the VMs can
+            # mint tokens against arrproxy's own bearer.
+            - name: ARRPROXY_ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: arrproxy-admin-token
+                  key: token
             # DSN assembled from the CNPG-generated arrproxy-db-app Secret;
             # $(VAR) expansion resolves the two env entries defined above it.
             - name: ARRPROXY_DB_USER

apps/base/arrstack/arrproxy/oauth2-proxy-configmap.yaml

@@ -33,9 +33,14 @@ data:
   # set-xauthrequest is intentionally NOT set -- it only populates auth_request
   # *response* headers, which never reach an --upstreams-proxied backend.
   OAUTH2_PROXY_PASS_USER_HEADERS: "true"
-  # Bypass auth ONLY for the *arr proxy API (/<app>/api...): this matches
-  # /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
-  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
+  # Bypass auth for the *arr proxy API (/<app>/api...) and the machine-mint
+  # admin route (/api/admin/...). The first matches /sonarr/api; the second
+  # matches /api/admin/ only -- both routed to the arrproxy-api upstream by the
+  # catch-all /api/ prefix above. /api/admin/ is protected by arrproxy's OWN
+  # ARRPROXY_ADMIN_TOKEN bearer (OpenBao on the VMs reaches it via the ingress),
+  # so it is intentionally oauth-skipped. /api/tokens and /api/me are NOT
+  # matched and stay oauth-authenticated.
+  OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api,^/api/admin/"
   OAUTH2_PROXY_EMAIL_DOMAINS: "*"
   # Authentik hardcodes email_verified=false in the id_token; without this
   # oauth2-proxy rejects the session ("email ... isn't verified") -> 500 on

apps/base/arrstack/arrproxy/ui-deployment.yaml

@@ -31,7 +31,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/arrstack/arrproxy/vaultstaticsecret.yaml

@@ -25,6 +25,33 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
+# Machine-mint admin bearer token. Seeded (openssl rand) at
+# kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token (key: token) and
+# shared as the source of truth with the future Vault engine. The default k8s
+# role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs it into the arrproxy-admin-token Secret consumed by arrproxy-api as
+# ARRPROXY_ADMIN_TOKEN to gate the bearer-protected /api/admin/ route.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: arrproxy-admin-token
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: arrproxy-admin-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/arrproxy-admin-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
 # Authentik OIDC client for the arrstack front door (client_id, client_secret,
 # cookie_secret), created by terraform-authentik at
 # kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into