Give vlogs its own namespace (#507)

The Vault KV layout is kubernetes/namespace/<ns>/<sa>/<secret>, so vlogs and logviewer both running as SA default in the shared logging namespace would collide on one oauth-credentials entry. Splitting vlogs out resolves it without widening any Vault policy.

- Move apps/base/logging/vlogs to apps/base/vlogs, namespace vlogs
- Add namespace.yaml and a vlogs-scoped VaultAuth (role default)
- Point the VaultStaticSecret at kubernetes/namespace/vlogs/default/oauth-credentials
- Add the au-syd1 overlay, platform ApplicationSet path and project destination
- Move the wildcard-unkin-net-tls reflection from logging to vlogs; vlogs was its only consumer there

Secret is already seeded at the new Vault path.

Reviewed-on: #507
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

argocd/projects/platform.yaml

@@ -67,6 +67,8 @@ spec:
       server: https://kubernetes.default.svc
     - namespace: 'vault'
       server: https://kubernetes.default.svc
+    - namespace: 'vlogs'
+      server: https://kubernetes.default.svc
     - namespace: 'woodpecker'
       server: https://kubernetes.default.svc
   clusterResourceWhitelist: