arrstack: mount legacy mediafs CephFS via static PV/PVC

Exposes the legacy mediafs filesystem to the arrstack namespace for the
upcoming mediamover tool. Adds a ceph-mediafs-secret VaultStaticSecret in
csi-cephfs and a 10Ti static RWX PV/PVC pair bound by claimRef.

apps/base/arrstack/pvc-mediafs.yaml

@@ -0,0 +1,20 @@
+---
+# Legacy mediafs filesystem root, statically bound to the arrstack-mediafs PV
+# for the upcoming mediamover tool. storageClassName "" + volumeName disables
+# dynamic provisioning and binds the pre-created static PV.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mediafs
+  namespace: arrstack
+  annotations:
+    k8up.io/backup: "false"
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: ""
+  volumeName: arrstack-mediafs
+  volumeMode: Filesystem