stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/kubernetes/setup_tls_secret/main.tf

@@ -1,25 +0,0 @@
-variable "namespace" { type = string }
-variable "tls_secret_name" {}
-variable "tls_crt" {
-  default = ""
-}
-variable "tls_key" {
-  default = ""
-}
-
-resource "kubernetes_secret" "tls_secret" {
-  metadata {
-    name      = var.tls_secret_name
-    namespace = var.namespace
-  }
-  data = {
-    # Cannot set default function in variable so use default behaviour here
-    "tls.crt" = var.tls_crt == "" ? file("${path.root}/secrets/fullchain.pem") : var.tls_crt
-    "tls.key" = var.tls_key == "" ? file("${path.root}/secrets/privkey.pem") : var.tls_key
-  }
-  type = "kubernetes.io/tls"
-  lifecycle {
-    # KYVERNO_LIFECYCLE_V1: the sync-tls-secret policy stamps generate.kyverno.io/* + app.kubernetes.io/managed-by labels on this generated Secret
-    ignore_changes = [metadata[0].labels]
-  }
-}