GKE: register the remaining tools, add the registry CA issuer

Adds nine Applications — external-secrets, harbor, jenkins, postgresql,
redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing
the cluster to the homelab's full set. Every nameOverride is pinned, which
is load-bearing rather than cosmetic in at least three cases:
external-secrets (its service account name is what vault-backend's
serviceAccountRef and Vault's auth role bind to), victoria-metrics-single
(its Service renders as <release>-server, the address vmagent and Grafana
both hardcode) and harbor (the pipeline refers to its object names).

extra-manifests gains the ClusterIssuer that makes cert-manager useful
here: a CA issuer over the registry-ca Secret, which is created by hand
from terraform output because the CA's private key exists only in
Terraform state and nothing can reconcile it from git.

Two homelab-only things removed rather than left to confuse: the Tailscale
Harbor Ingress, and the homelab cluster's own entry point and values file,
which have no meaning in a GCP-only repo. app-of-secretstores and
app-of-extra-manifests now point at this cluster's Gitea over cluster DNS,
and harbor-robot-dockerconfig is keyed to this cluster's registry hostname
— docker matches stored credentials by exact host, so the homelab's would
have silently pushed unauthenticated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

secretstores/harbor-robot-dockerconfig.yaml

@@ -28,13 +28,14 @@ spec:
       type: kubernetes.io/dockerconfigjson
       data:
         # Keyed by exact registry hostname — docker matches credentials
-        # against the host portion of the image reference. Was
-        # harbor-core.harbor.svc.cluster.local; switched to the Contour
-        # ingress hostname alongside buildDocker.groovy and dind-pod.yaml
-        # so push/pull share one consistent, resolvable-from-anywhere
-        # reference.
+        # against the host portion of the image reference, so this must be
+        # the same hostname the pipeline pushes to, the node pool was told
+        # to trust, and Harbor's own externalURL uses. On GKE that is the
+        # Contour ingress host, never harbor-core.harbor.svc.cluster.local:
+        # cluster DNS resolves from a pod but not from the node's containerd
+        # doing the actual image pull.
         .dockerconfigjson: |
-          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+          {"auths":{"harbor.35.238.248.203.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
   data:
     - secretKey: username
       remoteRef: