stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/vault/providers.tf

@@ -1,49 +0,0 @@
-# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
-terraform {
-  required_providers {
-    vault = {
-      source  = "hashicorp/vault"
-      version = "~> 4.0"
-    }
-    cloudflare = {
-      source  = "cloudflare/cloudflare"
-      version = "~> 4"
-    }
-    authentik = {
-      source  = "goauthentik/authentik"
-      version = "~> 2024.10"
-    }
-    # kubectl (gavinbunney) — workaround for hashicorp/kubernetes
-    # `kubernetes_manifest` panics on Kyverno CRDs. See beads code-e2dp.
-    # Declared for all stacks but only used where opted-in.
-    kubectl = {
-      source  = "gavinbunney/kubectl"
-      version = "~> 1.14"
-    }
-  }
-}
-
-variable "kube_config_path" {
-  type    = string
-  default = "~/.kube/config"
-}
-
-provider "kubernetes" {
-  config_path = var.kube_config_path
-}
-
-provider "helm" {
-  kubernetes = {
-    config_path = var.kube_config_path
-  }
-}
-
-provider "vault" {
-  address          = "https://vault.viktorbarzin.me"
-  skip_child_token = true
-}
-
-provider "kubectl" {
-  config_path      = var.kube_config_path
-  load_config_file = true
-}

stacks/vault/secrets

@@ -1 +0,0 @@
-../../secrets

stacks/vault/terragrunt.hcl

@@ -1,8 +0,0 @@
-include "root" {
-  path = find_in_parent_folders()
-}
-
-dependency "platform" {
-  config_path  = "../platform"
-  skip_outputs = true
-}