Add VPS GitLab mirror-sync CronJob for Homelabv4 repo

GitLab's native pull-mirror feature is Premium/Ultimate-gated on this
chart/version - confirmed live: the project API rejects 'mirror' and
'import_url' as unrecognized params on this CE instance entirely.
Plain git equivalent instead: CronJob every 15min does
'git clone --mirror' from home's Scooby/Homelabv4 (read-only deploy
token) then 'git push --mirror' to the VPS copy (write_repository
PAT, since deploy tokens can't push - not a valid scope for them
either). Matches the original plan's 'Gitea pull mirror of the GitOps
source' intent now that real GitLab replaced Gitea. Both tokens in
Vault at secret/vps/gitlab-mirror, pulled via ExternalSecret.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/vps-standby/gitlab/manifests/mirror-sync-cronjob.yaml

@@ -0,0 +1,59 @@
+# Periodic git mirror: home's Scooby/Homelabv4 (the actual GitOps
+# source) -> VPS GitLab's copy of the same project. See
+# mirror-sync-secret.yaml for why this is a plain CronJob instead of
+# GitLab's native pull-mirror feature (Premium-gated, confirmed live
+# 2026-08-21). This is the VPS-standby equivalent of the original
+# plan's "Gitea pull mirror of the GitOps source" - same intent,
+# different mechanism now that real GitLab replaced Gitea here.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitlab-mirror-sync
+  namespace: gitlab
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      activeDeadlineSeconds: 600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: mirror-sync
+              image: alpine/git:2.43.0
+              command:
+                - sh
+                - -c
+                - |
+                  set -eu
+                  rm -rf /tmp/mirror.git
+                  git clone --mirror "https://${PULL_USERNAME}:${PULL_TOKEN}@gitlab.kube.huskypup.net/Scooby/Homelabv4.git" /tmp/mirror.git
+                  cd /tmp/mirror.git
+                  git push --mirror "https://root:${PUSH_TOKEN}@gitlab.vps.huskypup.net/Scooby/Homelabv4.git"
+                  echo "Mirror sync complete: $(date -u)"
+              env:
+                - name: PULL_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitlab-mirror-sync-secret
+                      key: pull_username
+                - name: PULL_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitlab-mirror-sync-secret
+                      key: pull_token
+                - name: PUSH_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitlab-mirror-sync-secret
+                      key: push_token
+              resources:
+                requests:
+                  cpu: 25m
+                  memory: 128Mi
+                limits:
+                  memory: 512Mi

infrastructure/vps-standby/gitlab/manifests/mirror-sync-secret.yaml

@@ -0,0 +1,39 @@
+# Credentials for mirror-sync-cronjob.yaml. GitLab's native repository
+# mirroring (pull mirror) is a Premium/Ultimate-gated feature as of this
+# chart version - confirmed live 2026-08-21: the API rejects `mirror`
+# and `import_url` as valid params on this CE instance entirely
+# ("allow_merge_on_skipped_pipeline, ... are missing" - i.e. neither
+# field is even recognized). So this CronJob does the plain-git
+# equivalent (clone --mirror / push --mirror) on a schedule instead.
+#
+# - pull_username/pull_token: read-only deploy token on HOME's
+#   Scooby/Homelabv4 project (deploy tokens can't have write_repository
+#   - it's not a valid scope for them, confirmed live).
+# - push_username/push_token: a write_repository-scoped Personal Access
+#   Token for VPS GitLab's root user (deploy tokens can't push either).
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitlab-mirror-sync
+  namespace: gitlab
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: gitlab-mirror-sync-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: pull_username
+      remoteRef:
+        key: vps/gitlab-mirror
+        property: username
+    - secretKey: pull_token
+      remoteRef:
+        key: vps/gitlab-mirror
+        property: token
+    - secretKey: push_token
+      remoteRef:
+        key: vps/gitlab-mirror
+        property: push_token