stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/authentik/t3-users.tf

@@ -1,33 +0,0 @@
-# "T3 Users" group — gates the devvm Claude Code Workstation (t3.viktorbarzin.me)
-# at the Authentik edge (the branch in admin-services-restriction.tf). The group
-# is created WITH its members atomically so enabling the gate can never lock
-# everyone (incl. wizard) out.
-#
-# emo / ancamilea / wizard are NOT Terraform-managed authentik_user resources in
-# this stack, so they're looked up by username — which in this Authentik instance
-# IS the user's email (verified live 2026-06-08): vbarzin@gmail.com, etc.
-#
-# Membership is in HCL for now (matches the roster's 3 users). FUTURE: when the
-# devvm provisioner reconciles T3 Users membership from roster.yaml via the
-# Authentik API, drop the `users` arg here so TF owns only the group's existence.
-
-data "authentik_user" "wizard" {
-  username = "vbarzin@gmail.com"
-}
-
-data "authentik_user" "emo" {
-  username = "emil.barzin@gmail.com"
-}
-
-data "authentik_user" "ancamilea" {
-  username = "ancaelena98@gmail.com"
-}
-
-resource "authentik_group" "t3_users" {
-  name = "T3 Users"
-  users = [
-    data.authentik_user.wizard.id,
-    data.authentik_user.emo.id,
-    data.authentik_user.ancamilea.id,
-  ]
-}