Add vaultwarden app (migrated from docker on 10.10.0.5)

- Pinned to 1.37.0 so the migration is not also an upgrade
- ADMIN_TOKEN rotated to an Argon2id PHC string, stored as a SealedSecret.
  The old token was plaintext AND set in config.json, which overrides env --
  both that key and signups_allowed were removed during migration so the
  Deployment is the source of truth. signups had been silently enabled.
- /admin keeps Authentik forward-auth at priority 1000 (Traefik's default
  priority is rule length; the old docker router used 10 vs an implicit 24
  and was therefore bypassed).
- vault.aleshym.co stays private: absent from the k3s public catchall and
  from the Docker Traefik wan entrypoint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/vaultwarden/vaultwarden-secret.yaml.example

@@ -0,0 +1,13 @@
+# Template only -- the real values live in vaultwarden-sealedsecret.yaml.
+# ADMIN_TOKEN is an Argon2id PHC string (vaultwarden hash --preset owasp),
+# NOT a plaintext token. Generate a replacement with:
+#   docker run --rm python:3.12-alpine sh -c \
+#     'pip install -q argon2-cffi && python -c "..."'
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vaultwarden-secret
+  namespace: vaultwarden
+type: Opaque
+stringData:
+  ADMIN_TOKEN: '$argon2id$v=19$m=19456,t=2,p=1$REPLACE$REPLACE'