migrate 16 plan-time stacks: vault data source → ESO + kubernetes_secret

Replaced data "vault_kv_secret_v2" with:
1. ExternalSecret (ESO syncs Vault KV → K8s Secret)
2. data "kubernetes_secret" (reads ESO-created secret at plan time)

This removes the Vault provider dependency at plan time for these
stacks — they now only need K8s API access, not a Vault token.

Stacks: actualbudget, affine, audiobookshelf, calibre, changedetection,
coturn, freedify, freshrss, grampsweb, navidrome, novelapp, ollama,
owntracks, real-estate-crawler, servarr, ytdlp

stacks/novelapp/main.tf

@@ -3,9 +3,31 @@ variable "tls_secret_name" {
   sensitive = true
 }
 
-data "vault_kv_secret_v2" "secrets" {
-  mount = "secret"
-  name  = "novelapp"
+resource "kubernetes_manifest" "external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "novelapp-secrets"
+      namespace = "novelapp"
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-kv"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "novelapp-secrets"
+      }
+      dataFrom = [{
+        extract = {
+          key = "novelapp"
+        }
+      }]
+    }
+  }
+  depends_on = [kubernetes_namespace.novelapp]
 }
 
 resource "kubernetes_namespace" "novelapp" {
@@ -24,16 +46,6 @@ module "tls_secret" {
   tls_secret_name = var.tls_secret_name
 }
 
-resource "kubernetes_secret" "novelapp_auth" {
-  metadata {
-    name      = "novelapp-auth"
-    namespace = kubernetes_namespace.novelapp.metadata[0].name
-  }
-  data = {
-    "auth-secret" = data.vault_kv_secret_v2.secrets.data["auth_secret"]
-  }
-}
-
 resource "kubernetes_persistent_volume_claim" "novelapp-data" {
   metadata {
     name      = "novelapp-data"
@@ -58,6 +70,9 @@ resource "kubernetes_deployment" "novelapp" {
       app  = "novelapp"
       tier = local.tiers.aux
     }
+    annotations = {
+      "reloader.stakater.com/auto" = "true"
+    }
   }
   lifecycle {
     ignore_changes = [
@@ -111,8 +126,8 @@ resource "kubernetes_deployment" "novelapp" {
             name = "AUTH_SECRET"
             value_from {
               secret_key_ref {
-                name = kubernetes_secret.novelapp_auth.metadata[0].name
-                key  = "auth-secret"
+                name = "novelapp-secrets"
+                key  = "auth_secret"
               }
             }
           }