feat(notesnook): migrate self-hosted Notesnook to k3s

Adds apps/notesnook (namespace, config, mongo rs0 StatefulSet, minio,
identity/sync/sse/monograph deployments + Traefik/cert-manager ingresses)
and argocd/notesnook.yaml. Secret applied out-of-band (only .example committed).
Includes design spec + implementation plan under docs/superpowers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/notesnook/notesnook-secret.yaml.example

@@ -0,0 +1,19 @@
+# DO NOT COMMIT THE REAL VERSION. Copy to notesnook-secret.yaml (gitignored),
+# fill real values from the old stack's .env, then:
+#   kubectl apply -f apps/notesnook/notesnook-secret.yaml
+# ArgoCD ignores this Secret's /data (see argocd/notesnook.yaml).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: notesnook-secret
+  namespace: notesnook
+stringData:
+  NOTESNOOK_API_SECRET: "CHANGE_ME"
+  SMTP_USERNAME: "funman300@gmail.com"
+  SMTP_PASSWORD: "CHANGE_ME"
+  SMTP_HOST: "smtp.gmail.com"
+  SMTP_PORT: "587"
+  MINIO_ROOT_USER: "notesnook"
+  MINIO_ROOT_PASSWORD: "CHANGE_ME"
+  S3_ACCESS_KEY_ID: "notesnook"
+  S3_ACCESS_KEY: "CHANGE_ME"