stem95su: scheduled Drive->site sync CronJob (every 10m)

CronJob stem95su-gdrive-sync (*/10) mounts the content PVC RW and
rclone-syncs the read-only Drive folder "claude" (stem claude/files) onto
it (rclone/rclone:1.74.3, scope=drive.readonly, empty-source guard +
--max-delete 25). ESO ExternalSecret stem95su-rclone <- Vault
secret/stem95su. Requires the GCP OAuth app published to Production or the
refresh token expires ~weekly.

Lands the gdrive-sync stack on master (it had landed on a feature branch
by accident on the shared devvm checkout).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/xray/modules/xray/xray_config.json.tpl

@@ -1,80 +0,0 @@
-{
-  "log": {
-    "loglevel": "none"
-  },
-  "inbounds": [
-    {
-      "port": 7443,
-      "protocol": "vless",
-      "settings": {
-        "clients": ${clients},
-        "decryption": "none"
-      },
-      "streamSettings": {
-        "network": "tcp",
-        "security": "reality",
-        "realitySettings": {
-          "show": false,
-          "dest": "www.cloudflare.com:443",
-          "xver": 0,
-          "serverNames": [
-            "www.cloudflare.com"
-          ],
-          "privateKey": "${reality_private_key}",
-          "shortIds": ${reality_short_ids}
-        }
-      }
-    },
-    {
-      "port": 8443,
-      "protocol": "vless",
-      "settings": {
-        "clients": ${clients},
-        "decryption": "none"
-      },
-      "streamSettings": {
-        "network": "ws",
-        "security": "none",
-        "tlsSettings": {
-          "certificates": [
-            {
-              "certificateFile": "/etc/xray/tls.crt",
-              "keyFile": "/etc/xray/tls.key"
-            }
-          ]
-        },
-        "wsSettings": {
-          "path": "/ws"
-        }
-      }
-    },
-    {
-      "port": 9443,
-      "protocol": "vless",
-      "settings": {
-        "clients": ${clients},
-        "decryption": "none"
-      },
-      "streamSettings": {
-        "network": "xhttp",
-        "security": "none",
-        "tlsSettings": {
-          "certificates": [
-            {
-              "certificateFile": "/etc/xray/tls.crt",
-              "keyFile": "/etc/xray/tls.key"
-            }
-          ]
-        },
-        "xhttpSettings": {
-          "path": "/grpc-vpn"
-        }
-      }
-    }
-  ],
-  "outbounds": [
-    {
-      "protocol": "freedom"
-    }
-  ]
-}