feat(minecraft): deploy journey-into-imagination PaperMC server

- PaperMC 26.1.2 via itzg/minecraft-server:2026.7.0
- Namespace: minecraft, Service: journey-into-imagination
- TCP port 10182 (non-standard) via ingress-nginx tcp forwarding
- Pure Storage CSI PVC (pure-block, 50Gi) for world data
- World seed hardcoded: -5177989977648707969
- RCON password via ExternalSecret + 1Password Connect
- SleepMost v5.6.2 plugin for single-player sleep
- Whitelist off at launch, toggle-ready
- ExternalDNS annotations for internal Technitium record
- Manual steps: UniFi port forward WAN:10182→10.1.71.80:10182,
  Cloudflare A record + SRV for journey-into-imagination.mk-labs.cloud

cluster/applications/minecraft/externalsecret.yaml

@@ -0,0 +1,28 @@
+---
+# ExternalSecret — pulls RCON password from 1Password Connect
+# Prereq: create a "minecraft" item in the mk-labs 1Password vault
+#   with a field named "rcon_password" set to a strong random password.
+#   Generate one: openssl rand -base64 24
+#
+# ClusterSecretStore: onepassword-connect (platform/onepassword-connect/)
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: papermc-rcon
+  namespace: minecraft
+  labels:
+    app.kubernetes.io/name: minecraft
+    app.kubernetes.io/component: papermc
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-connect
+    kind: ClusterSecretStore
+  target:
+    name: papermc-rcon
+    creationPolicy: Owner
+  data:
+    - secretKey: rcon-password
+      remoteRef:
+        key: minecraft
+        property: rcon_password