migrate consuming stacks to ESO + remove k8s-dashboard static token

Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin

stacks/k8s-dashboard/main.tf

@@ -131,16 +131,8 @@ resource "kubernetes_cluster_role_binding" "kubernetes-dashboard" {
   # depends_on = [module.dashboard]
 }
 
-resource "kubernetes_secret" "kubernetes-dashboard-admin-token" {
-  metadata {
-    name      = "kubernetes-dashboard-admin"
-    namespace = kubernetes_namespace.k8s-dashboard.metadata[0].name
-    annotations = {
-      "kubernetes.io/service-account.name" : "kubernetes-dashboard"
-    }
-  }
-  type = "kubernetes.io/service-account-token"
-}
+# Admin token: use `vault write kubernetes/creds/dashboard-admin kubernetes_namespace=kubernetes-dashboard`
+# instead of a static never-expiring token.
 
 ## Readonly RBAC
 resource "kubernetes_cluster_role" "kubernetes-dashboard-viewonly" {

stacks/k8s-dashboard/providers.tf

@@ -1,8 +1,16 @@
 # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
 variable "kube_config_path" {
-  type      = string
-  default   = "~/.kube/config"
-  sensitive = true
+  type    = string
+  default = "~/.kube/config"
 }
 
 provider "kubernetes" {
@@ -14,3 +22,8 @@ provider "helm" {
     config_path = var.kube_config_path
   }
 }
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}