GKE: register the remaining tools, add the registry CA issuer

Adds nine Applications — external-secrets, harbor, jenkins, postgresql,
redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing
the cluster to the homelab's full set. Every nameOverride is pinned, which
is load-bearing rather than cosmetic in at least three cases:
external-secrets (its service account name is what vault-backend's
serviceAccountRef and Vault's auth role bind to), victoria-metrics-single
(its Service renders as <release>-server, the address vmagent and Grafana
both hardcode) and harbor (the pipeline refers to its object names).

extra-manifests gains the ClusterIssuer that makes cert-manager useful
here: a CA issuer over the registry-ca Secret, which is created by hand
from terraform output because the CA's private key exists only in
Terraform state and nothing can reconcile it from git.

Two homelab-only things removed rather than left to confuse: the Tailscale
Harbor Ingress, and the homelab cluster's own entry point and values file,
which have no meaning in a GCP-only repo. app-of-secretstores and
app-of-extra-manifests now point at this cluster's Gitea over cluster DNS,
and harbor-robot-dockerconfig is keyed to this cluster's registry hostname
— docker matches stored credentials by exact host, so the homelab's would
have silently pushed unauthenticated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

extra-manifests/harbor-ingress-tailscale.yaml

@@ -1,56 +0,0 @@
-# Harbor's chart has no multi-host mechanism at all (checked against the
-# actual template — no extraHosts like argo-cd, no secondaryingress like
-# jenkins), so this is a standalone second Ingress for the Tailscale
-# hostname. Correction from an earlier version of this file: it routed
-# everything to harbor-core alone. That's wrong — harbor-core is the
-# API/auth backend; the actual web UI (the portal you log into) is served
-# by harbor-portal. Mirrors the chart's own generated Ingress path split
-# exactly (confirmed against its real rendered spec, not assumed this
-# time): /api/, /service/, /v2/, /c/ go to harbor-core, everything else
-# goes to harbor-portal.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: harbor-ingress-tailscale
-  namespace: harbor
-spec:
-  ingressClassName: contour
-  rules:
-    - host: "harbor.100.90.248.118.nip.io"
-      http:
-        paths:
-          - path: /api/
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor-core
-                port:
-                  number: 80
-          - path: /service/
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor-core
-                port:
-                  number: 80
-          - path: /v2/
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor-core
-                port:
-                  number: 80
-          - path: /c/
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor-core
-                port:
-                  number: 80
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor-portal
-                port:
-                  number: 80

extra-manifests/registry-ca-clusterissuer.yaml

@@ -0,0 +1,31 @@
+# The issuer that signs Harbor's certificate, from the private CA the GKE
+# node pool was told to trust.
+#
+# Terraform generates that CA and puts its PUBLIC key in Secret Manager,
+# which is what every node fetches to verify image pulls. cert-manager needs
+# both halves in order to sign, so the key pair is created as the
+# `registry-ca` Secret in the cert-manager namespace by hand, from
+# `terraform output` — the private key exists nowhere else, so nothing can
+# reconcile it from git:
+#
+#   TF=~/Documents/localgit/toolshed-gke-infra/envs/prod/10-infra
+#   kubectl -n cert-manager create secret tls registry-ca \
+#     --cert=<(terraform -chdir=$TF output -raw registry_ca_cert_pem) \
+#     --key=<(terraform -chdir=$TF output -raw registry_ca_key_pem)
+#
+# A ClusterIssuer, not an Issuer, so Harbor's namespace can request a
+# certificate without the CA's private key being copied there. Note that a
+# ClusterIssuer always reads its secret from cert-manager's own namespace,
+# which is what makes that possible.
+#
+# This is the whole reason cert-manager is installed at all: nothing else in
+# this cluster uses TLS. Let's Encrypt cannot help here, because nip.io is
+# not on the public suffix list and every *.nip.io certificate shares one
+# rate limit.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: registry-ca-issuer
+spec:
+  ca:
+    secretName: registry-ca