firecrawl: Day 4 - Add ExternalSecret for 1Password integration

- Add ExternalSecret manifest to sync firecrawl secrets from 1Password
- Configure POSTGRES_PASSWORD and BULL_AUTH_KEY from mk-labs vault
- Add comprehensive SECRETS_SETUP.md documentation
- Verified ExternalSecrets Operator successfully synced secrets
- All 18 deployment manifests validated with dry-run

Status: firecrawl-secrets Secret created and populated correctly

cluster/applications/firecrawl/externalsecret.yaml

@@ -0,0 +1,34 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: firecrawl-secrets
+  namespace: firecrawl
+  labels:
+    app.kubernetes.io/name: firecrawl
+    app.kubernetes.io/component: secrets
+    app.kubernetes.io/part-of: firecrawl
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: firecrawl-secrets
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      type: Opaque
+      data:
+        # PostgreSQL database password
+        POSTGRES_PASSWORD: "{{ .postgresPassword }}"
+        # Redis Bull queue admin UI authentication key
+        BULL_AUTH_KEY: "{{ .bullAuthKey }}"
+  data:
+    - secretKey: postgresPassword
+      remoteRef:
+        key: firecrawl
+        property: postgres-password
+    - secretKey: bullAuthKey
+      remoteRef:
+        key: firecrawl
+        property: bull-auth-key