stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cli/openwrt_dns.go

@@ -1,63 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"fmt"
-	"log"
-	"os"
-
-	"golang.org/x/crypto/ssh"
-)
-
-const (
-	sshKeyPathEnvVarName       = "SSH_KEY"
-	setupOpenWRTDNSFlagName    = "setup-openwrt-dns"
-	setupOpenWRTNewDNSFlagName = "new-dns"
-
-	openWRTUser = "root"
-	openWRTHost = "192.168.1.1:22" // Using IP because assuming DNS is down
-)
-
-var (
-	sshKeyPath, _ = os.LookupEnv(sshKeyPathEnvVarName)
-)
-
-// SetOpenWRTDNS ssh-es into `host` and sets `dns` as it's primary dns for dnsmasq
-func SetOpenWRTDNS(privateKey []byte, dns string) (string, error) {
-	signer, err := ssh.ParsePrivateKey(privateKey)
-	if err != nil {
-		log.Fatalf("unable to parse private key: %v", err)
-	}
-
-	config := &ssh.ClientConfig{
-		User: openWRTUser,
-		Auth: []ssh.AuthMethod{
-			ssh.PublicKeys(signer),
-		},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-	}
-	client, err := ssh.Dial("tcp", openWRTHost, config)
-	if err != nil {
-		log.Fatal("Failed to dial: ", err)
-	}
-	defer client.Close()
-
-	session, err := client.NewSession()
-	if err != nil {
-		log.Fatal("Failed to create session: ", err)
-	}
-	defer session.Close()
-
-	cmd := openwrtDNSUpdateCmd(dns)
-	var b bytes.Buffer
-	session.Stdout = &b
-	if err := session.Run(cmd); err != nil {
-		log.Fatal("Failed to run: " + err.Error())
-	}
-	fmt.Println(b.String())
-	return "", nil
-}
-
-func openwrtDNSUpdateCmd(newDNS string) string {
-	return fmt.Sprintf("sed -i \"s/\\slist server.*/ list server '%s'/\" /etc/config/dhcp && /etc/init.d/dnsmasq reload", newDNS)
-}