Add VPS warm-standby/backup site (Phase 0-1b)

Foundation for a DR/backup path using an always-on VPS as a second
ArgoCD-managed cluster, plus DB/backup standardization work that fell
out of it:

- vps-standby ArgoCD cluster destination + AppProject, MinIO backup
  receiver, VPS bootstrap script (k3s, Netbird, cert-manager)
- Dual-site DNS failover watcher + home-IP DDNS CronJob, Cloudflare
  token moved out of git into Vault+ExternalSecret
- Nextcloud migrated from ad-hoc MariaDB to CNPG + redis-operator
  (matches n8n/Authentik/GitLab's backup-native pattern)
- Authentik's CNPG manifests moved into the actual ArgoCD-synced
  manifests/ path (were present but never wired into the sync path)
- Vault raft-snapshot CronJob, CNPG barmanObjectStore backups
  (Authentik/n8n/Nextcloud), Nextcloud file-PVC restic sync - all
  targeting the new VPS MinIO receiver

See VPS Warm-Standby plan doc for full design rationale.

infrastructure/vps-standby/minio/values.yaml

@@ -0,0 +1,55 @@
+# MinIO on the VPS - shared backup-receiver bucket for the vps-standby site.
+# Standalone mode: single node, single VPS disk, no erasure coding needed here -
+# this is a backup *copy*, not itself something requiring HA.
+#
+# rootUser/rootPassword are intentionally left unset: the chart auto-generates
+# a random root password and stores it in a Secret (minio/minio chart default
+# behavior) rather than committing credentials to git. Retrieve after first
+# deploy with:
+#   kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d
+
+mode: standalone
+
+persistence:
+  enabled: true
+  storageClass: local-path
+  size: 150Gi  # budget out of the VPS's 360GB disk; leaves room for Phase 2 standby PVCs
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 1Gi
+
+# Buckets used by the backup/standby plumbing (Phase 1b / Phase 2). Created on
+# first deploy; safe to append to as later phases land.
+buckets:
+  - name: vault-raft-snapshots
+    policy: none
+    purge: false
+  - name: cnpg-backups
+    policy: none
+    purge: false
+  - name: nextcloud-files
+    policy: none
+    purge: false
+
+# No ingress here - MinIO is reached over Netbird (while home is up) or from
+# workloads inside the vps-standby cluster itself. It never needs to be public.
+ingress:
+  enabled: false
+
+# NodePort so home-cluster CronJobs (vault raft snapshots, CNPG barman backups,
+# Nextcloud PVC sync) can reach this over the Netbird tunnel at
+# <VPS_NETBIRD_IP>:30900 - single-node cluster, so NodePort is simplest here.
+# Verify the exact key path against `helm show values minio/minio` for the
+# deployed chart version (5.4.0) before applying - not confirmed live.
+service:
+  type: NodePort
+  nodePort: 30900
+
+metrics:
+  serviceMonitor:
+    enabled: false  # no Prometheus on the VPS cluster (out of scope for this build)