feat(notesnook): migrate self-hosted Notesnook to k3s

Adds apps/notesnook (namespace, config, mongo rs0 StatefulSet, minio,
identity/sync/sse/monograph deployments + Traefik/cert-manager ingresses)
and argocd/notesnook.yaml. Secret applied out-of-band (only .example committed).
Includes design spec + implementation plan under docs/superpowers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/notesnook/minio-bucket-job.yaml

@@ -0,0 +1,26 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: notesnook-s3-setup
+  namespace: notesnook
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 20
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: mc
+          image: minio/mc:RELEASE.2024-07-26T13-08-44Z
+          envFrom:
+            - secretRef: { name: notesnook-secret }
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              until mc alias set minio http://notesnook-s3:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"; do
+                sleep 2;
+              done
+              mc mb --ignore-existing minio/attachments
+              echo "bucket ready"