feat: initial scaffold from helm-template

- Keycloak Operator v26 deployed to keycloak-system namespace
- Keycloak HA instance (2 replicas, jdbc-ping cluster discovery)
- Dedicated CNPG cluster (local-postgres storage, 2 instances)
- KeycloakRealmImport: home-lab realm with groups and traefik-oidc client
- Traefik IngressRoute: login.olb42.com (CF Access bypass)
- Admin credentials placeholder (seal before first deploy)
- ArgoCD ApplicationSets: login-operator + login

manifest/overlays/production/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: login
+
+resources:
+  - ../../base/state
+  - cnpg-cluster.yaml
+  - keycloak-instance.yaml
+  - keycloak-realm-home-lab.yaml
+  - ingressroute.yaml
+  - admin.sealed.secret.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: login
+  app.kubernetes.io/environment: production