feat(openviking): pilot deployment to fastpass (wave 8)

Platform Knowledge Infrastructure pilot - context database for large
file trees, shared skills, and long-term logs to reduce agent token
consumption. Pilot scope: two corpora (hermes/ skills library,
personal/homelab/), two consumer profiles (Wong, Shuri) for before/after
token comparison.

- namespace.yaml: openviking namespace, sync-wave 8 (after Harbor wave 7)
- externalsecret.yaml: credentials from 1Password via onepassword-connect
  ClusterSecretStore (Wong, t_32766900)
- values.yaml: Helm overrides - px-fa-direct-access storage (30Gi),
  embedding (nomic-embed-text-v1.5) + VLM (Llama-3.1-8B) via astro-orbiter
  router (:8002), internal-only ingress
- application.yaml: multi-source ArgoCD Application, Harbor pattern
  (Peter Parker, t_eefdcc17 + reconciled in t_3e54efa8)

Prerequisites verified complete before this commit:
- nomic-embed-text-v1.5-Q4_K_M live on astro-orbiter router (War Machine,
  t_34b96e83, commit ad70b34)
- All 3 1Password items provisioned (root/embedding/vlm api keys)
- Storage class corrected to px-fa-direct-access after live PV audit
  showed pure-block/pure-file have zero provisioned volumes (t_77b3ff79)
- Dry-run validated against live cluster prior to commit

Constraint: vault (~/friday) remains canonical source of truth; OpenViking
index is a derived cache, rebuilt from vault source files.

Honcho/lincoln explicitly out of scope for this work.

cluster/platform/openviking/externalsecret.yaml

@@ -0,0 +1,55 @@
+# ExternalSecret - OpenViking Credentials
+# Wong, Phase 1, t_32766900
+#
+# Syncs OpenViking credentials from 1Password mk-labs vault
+# Pattern: Harbor proven pattern (cluster/platform/harbor/externalsecret.yaml)
+# Store: onepassword-connect ClusterSecretStore
+# Namespace: openviking (created by Peter Parker in Phase 2)
+# Wave: 8 (after Harbor Wave 7)
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: openviking-credentials
+  namespace: openviking
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+    description: "Phase 1 secrets for OpenViking deployment"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: openviking-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        root_api_key: "{{ .OPENVIKING_ROOT_API_KEY }}"
+        embedding_api_key: "{{ .OPENVIKING_EMBEDDING_API_KEY }}"
+        vlm_api_key: "{{ .OPENVIKING_VLM_API_KEY }}"
+
+  data:
+    # OpenViking root API key - server administration
+    # Source: 1Password item "openviking-root-api-key", field "root-api-key"
+    - secretKey: OPENVIKING_ROOT_API_KEY
+      remoteRef:
+        key: openviking-root-api-key
+        property: root-api-key
+
+    # Embedding model endpoint token (nomic-embed-text-v1.5 at astro-orbiter:8002)
+    # Source: 1Password item "openviking-embedding-api-key", field "api-key"
+    # Phase 0 recommendation: placeholder token for local endpoint
+    - secretKey: OPENVIKING_EMBEDDING_API_KEY
+      remoteRef:
+        key: openviking-embedding-api-key
+        property: api-key
+
+    # VLM endpoint token (Llama-3.1-8B at astro-orbiter:8002)
+    # Source: 1Password item "openviking-vlm-api-key", field "api-key"
+    # Phase 0 recommendation: placeholder token for local endpoint
+    - secretKey: OPENVIKING_VLM_API_KEY
+      remoteRef:
+        key: openviking-vlm-api-key
+        property: api-key