deploy Sealed Secrets controller for encrypted secret management

Adds Sealed Secrets (Bitnami) to the platform stack so cluster users can
encrypt secrets with a public key and commit SealedSecret YAMLs to git.
The in-cluster controller decrypts them into regular K8s Secrets.

- New module: sealed-secrets (namespace + Helm chart v2.18.3, cluster tier)
- k8s-portal setup script: adds kubeseal CLI install for Linux and Mac

stacks/platform/modules/k8s-portal/files/src/routes/setup/script/+server.ts

@@ -92,6 +92,19 @@ else
     echo "[OK] kubelogin installed"
 fi
 
+# Install kubeseal
+if command -v kubeseal &>/dev/null; then
+    echo "[OK] kubeseal already installed"
+else
+    echo "[..] Installing kubeseal..."
+    KUBESEAL_VERSION=\$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/bitnami-labs/sealed-secrets/releases/latest | grep -o '[^/]*\$')
+    curl -fsSLO "https://github.com/bitnami-labs/sealed-secrets/releases/download/\${KUBESEAL_VERSION}/kubeseal-\${KUBESEAL_VERSION#v}-linux-amd64.tar.gz"
+    tar -xzf "kubeseal-\${KUBESEAL_VERSION#v}-linux-amd64.tar.gz" kubeseal
+    \$SUDO mv kubeseal "\$INSTALL_DIR/"
+    rm -f "kubeseal-\${KUBESEAL_VERSION#v}-linux-amd64.tar.gz"
+    echo "[OK] kubeseal installed"
+fi
+
 # Write kubeconfig
 mkdir -p ~/.kube
 cat > ~/.kube/config-home << 'KUBECONFIG_EOF'
@@ -146,6 +159,15 @@ else
     echo "[OK] kubelogin installed"
 fi
 
+# Install kubeseal
+if command -v kubeseal &>/dev/null; then
+    echo "[OK] kubeseal already installed"
+else
+    echo "[..] Installing kubeseal..."
+    brew install kubeseal
+    echo "[OK] kubeseal installed"
+fi
+
 # Write kubeconfig
 mkdir -p ~/.kube
 cat > ~/.kube/config-home << 'KUBECONFIG_EOF'