feat(deploy): Datasette analytics sidecar + analytics.aleshym.co ingress

Adds a Datasette container alongside the existing server in the same pod so
it can read the SQLite PVC without a second ReadWriteOnce mount. Protected
by a Traefik BasicAuth middleware at analytics.aleshym.co.

Also fixes the ArgoCD repoURL to point to the migrated Gitea hostname
(git.aleshym.co) instead of the old bare IP.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

deploy/secret-analytics-auth.yaml

@@ -0,0 +1,10 @@
+# Default credentials: admin / solitaire-analytics
+# To change: htpasswd -nbm admin 'NEWPASSWORD'
+# Then replace the users value below and re-apply.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: analytics-auth-secret
+  namespace: solitaire
+stringData:
+  users: "admin:$apr1$AAZ1wWNs$kMdJTfbPTcUZVX5ryY5gP1"