Add ExternalSecrets for Harbor robot account credentials

Creates two docker-registry secrets from 1Password:
1. harbor-tekton-robot - for Tekton CI/CD pipeline push/pull
2. harbor-pull-secret - for fastpass cluster image pulls

Both sync from 1Password item 'harbor-robot-accounts' with fields:
- tekton-builder-username / tekton-builder-password
- fastpass-cluster-username / fastpass-cluster-password

Credentials document placed in PKA inbox for manual 1Password entry.
Once stored, ESO will automatically sync and create the secrets.

cluster/platform/harbor/externalsecret-pull-secret.yaml

@@ -0,0 +1,38 @@
+# ExternalSecret for fastpass cluster image pull credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Kubernetes image pulls
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-pull-secret
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .fastpass_username }}",
+                "password": "{{ .fastpass_password }}",
+                "auth": "{{ printf "%s:%s" .fastpass_username .fastpass_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: fastpass_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-username
+    - secretKey: fastpass_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-password

cluster/platform/harbor/externalsecret-tekton-robot.yaml

@@ -0,0 +1,38 @@
+# ExternalSecret for Tekton robot account credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Tekton pipeline authentication
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-tekton-robot
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-tekton-robot
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .tekton_username }}",
+                "password": "{{ .tekton_password }}",
+                "auth": "{{ printf "%s:%s" .tekton_username .tekton_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: tekton_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-username
+    - secretKey: tekton_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-password