feat(notesnook): migrate self-hosted Notesnook to k3s

Adds apps/notesnook (namespace, config, mongo rs0 StatefulSet, minio,
identity/sync/sse/monograph deployments + Traefik/cert-manager ingresses)
and argocd/notesnook.yaml. Secret applied out-of-band (only .example committed).
Includes design spec + implementation plan under docs/superpowers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/notesnook/notesnook-config.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: notesnook-config
+  namespace: notesnook
+data:
+  INSTANCE_NAME: "aleshym-notesnook"
+  DISABLE_SIGNUPS: "true"
+  NOTESNOOK_APP_PUBLIC_URL: "https://app.notesnook.com"
+  AUTH_SERVER_PUBLIC_URL: "https://auth.notes.aleshym.co"
+  MONOGRAPH_PUBLIC_URL: "https://monograph.notes.aleshym.co"
+  ATTACHMENTS_SERVER_PUBLIC_URL: "https://attachments.notes.aleshym.co"
+  NOTESNOOK_CORS_ORIGINS: "https://app.notesnook.com,https://notes.aleshym.co"
+  KNOWN_PROXIES: ""
+  SELF_HOSTED: "1"
+  NOTESNOOK_SERVER_HOST: "notesnook-sync"
+  NOTESNOOK_SERVER_PORT: "5264"
+  IDENTITY_SERVER_HOST: "notesnook-identity"
+  IDENTITY_SERVER_PORT: "8264"
+  SSE_SERVER_HOST: "notesnook-sse"
+  SSE_SERVER_PORT: "7264"
+  IDENTITY_SERVER_URL: "https://auth.notes.aleshym.co"
+  NOTESNOOK_APP_HOST: "https://app.notesnook.com"
+  S3_INTERNAL_SERVICE_URL: "http://notesnook-s3:9000"
+  S3_INTERNAL_BUCKET_NAME: "attachments"
+  S3_SERVICE_URL: "https://attachments.notes.aleshym.co"
+  S3_BUCKET_NAME: "attachments"
+  S3_REGION: "us-east-1"
+  MINIO_BROWSER: "on"