stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/authentik/modules/authentik/values.yaml

@@ -1,113 +0,0 @@
-authentik:
-  log_level: warning
-  # log_level: trace
-  secret_key: ""
-  existingSecret:
-    secretName: "goauthentik"
-  # This sends anonymous usage-data, stack traces on errors and
-  # performance data to authentik.error-reporting.a7k.io, and is fully opt-in
-  error_reporting:
-    enabled: false
-  postgresql:
-    # host: postgresql.dbaas
-    host: pgbouncer.authentik
-    port: 6432
-    user: authentik
-    password: ""
-    # Persistent client-side connections (safe with PgBouncer session mode;
-    # must be < pgbouncer server_idle_timeout=600s). Cuts Django connection
-    # setup overhead off the ~70 sequential ORM ops per flow stage.
-    conn_max_age: 60
-    conn_health_checks: true
-  cache:
-    # Cache flow plans for 30m and policy evaluations for 15m. Authentik 2026.2
-    # moved cache storage from Redis to Postgres, so a TTL hit is still a
-    # SELECT — but a single indexed lookup beats re-evaluating PolicyBindings.
-    timeout_flows: 1800
-    timeout_policies: 900
-  web:
-    # Gunicorn: 3 workers × 4 threads per server pod (default 2×4).
-    # Pairs with the server memory bump to 2Gi (each worker preloads Django ~500Mi).
-    workers: 3
-    threads: 4
-  worker:
-    # Celery-equivalent worker threads per pod (default 2, renamed from
-    # AUTHENTIK_WORKER__CONCURRENCY in 2025.8).
-    threads: 4
-
-server:
-  replicas: 3
-  # Anonymous Django sessions (no completed login: bots, healthcheckers,
-  # partial flows) expire in 2h. Default is days=1. Once login completes,
-  # UserLoginStage.session_duration takes over via request.session.set_expiry.
-  # Injected via server.env (not authentik.sessions.*) because we use
-  # authentik.existingSecret.secretName, which makes the chart skip
-  # rendering the AUTHENTIK_* secret — so the values block doesn't reach env.
-  env:
-    - name: AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE
-      value: "hours=2"
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-  resources:
-    requests:
-      cpu: 100m
-      memory: 1.5Gi
-    limits:
-      memory: 2Gi
-  topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/component: server
-  ingress:
-    enabled: false
-    # hosts:
-    #   - authentik.viktorbarzin.me
-  podAnnotations:
-    diun.enable: true
-    diun.include_tags: "^202[0-9].[0-9]+.*$" # no need to annotate the worker as it uses the same image
-  pdb:
-    enabled: true
-    minAvailable: 2
-global:
-  addPrometheusAnnotations: true
-
-worker:
-  # 2 replicas: workers handle background tasks (LDAP sync, email,
-  # certificate renewal) — no user-facing traffic, so 2-of-3 isn't
-  # needed for availability. Drop saves ~100m sustained CPU.
-  replicas: 2
-  # Same unauthenticated_age cap as server — both the server (Django session
-  # middleware) and worker (cleanup tasks) need to see the value.
-  env:
-    - name: AUTHENTIK_SESSIONS__UNAUTHENTICATED_AGE
-      value: "hours=2"
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
-  resources:
-    requests:
-      cpu: 100m
-      memory: 1.5Gi
-    limits:
-      memory: 2Gi
-  topologySpreadConstraints:
-    - maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: ScheduleAnyway
-      labelSelector:
-        matchLabels:
-          app.kubernetes.io/component: worker
-  pdb:
-    enabled: true
-    maxUnavailable: 1
-
-postgresql:
-  enabled: false