fix(harbor): correct naming convention and use staging certs

- Rename application/namespace: the-seas -> harbor
- Move directory: cluster/platform/the-seas -> cluster/platform/harbor
- Update all resource references (ExternalSecret, HTTPRoutes, Certificates)
- Switch to letsencrypt-staging issuer (avoid ACME rate limits during testing)
- Thematic name 'the-seas' remains in DNS hostnames and comments

cluster/platform/harbor/externalsecret.yaml

@@ -0,0 +1,52 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Harbor Credentials
+# Pulled from 1Password via Connect Server, materialized as a K8s secret
+# in the-seas namespace for use by Harbor components.
+#
+# In 1Password, these are stored in the "the-seas" item in the "mk-labs" vault
+# with fields: harbor-admin-password, database-password, redis-password,
+# core-secret, jobservice-secret, registry-password
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-credentials
+  namespace: harbor
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  refreshInterval: "1h"
+  target:
+    name: harbor-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: HARBOR_ADMIN_PASSWORD
+      remoteRef:
+        key: the-seas
+        property: harbor-admin-password
+    
+    - secretKey: DATABASE_PASSWORD
+      remoteRef:
+        key: the-seas
+        property: database-password
+    
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        key: the-seas
+        property: redis-password
+    
+    - secretKey: CORE_SECRET
+      remoteRef:
+        key: the-seas
+        property: core-secret
+    
+    - secretKey: JOBSERVICE_SECRET
+      remoteRef:
+        key: the-seas
+        property: jobservice-secret
+    
+    - secretKey: REGISTRY_PASSWD
+      remoteRef:
+        key: the-seas
+        property: registry-password