Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/applications/litellm/externalsecret.yaml

@@ -0,0 +1,82 @@
+# ExternalSecrets - LiteLLM
+# Store: onepassword-connect ClusterSecretStore (vaults: mk-labs, wdw-labs)
+#
+# 1Password, vault wdw-labs:
+#   Item "litellm" (CONCEALED fields):
+#     master-key         LiteLLM admin/master key (must start with "sk-")
+#     salt-key           LITELLM_SALT_KEY — encrypts stored provider creds. NEVER ROTATE.
+#     db-password        Postgres password for user "litellm" (use alphanumerics,
+#                        e.g. `openssl rand -hex 24`; it is embedded in a URL)
+#     db-admin-password  Postgres "postgres" superuser password
+#   Items "illuminations", "fantasmic", "wishes" — field "api-key"
+#
+# Wave -1: secrets exist before the Deployment / migration job / Postgres.
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: litellm-credentials
+  namespace: litellm
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: litellm-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # Chart masterkeySecretName/Key
+        master-key: "{{ .MASTER_KEY }}"
+        # Chart db.secret + bundled Postgres existingSecret
+        username: litellm
+        password: "{{ .DB_PASSWORD }}"
+        postgres-password: "{{ .DB_ADMIN_PASSWORD }}"
+  data:
+    - secretKey: MASTER_KEY
+      remoteRef: { key: litellm, property: master-key }
+    - secretKey: DB_PASSWORD
+      remoteRef: { key: litellm, property: db-password }
+    - secretKey: DB_ADMIN_PASSWORD
+      remoteRef: { key: litellm, property: db-admin-password }
+---
+# Exported wholesale as env vars via chart `environmentSecrets`
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: litellm-env
+  namespace: litellm
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: litellm-env
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        LITELLM_SALT_KEY: "{{ .SALT_KEY }}"
+        # Full URL for the proxy Deployment (see values.yaml environmentSecrets note)
+        DATABASE_URL: "postgresql://litellm:{{ .DB_PASSWORD | urlquery }}@litellm-postgresql:5432/litellm"
+        ILLUMINATIONS_API_KEY: "{{ .ILLUMINATIONS_API_KEY }}"
+        FANTASMIC_API_KEY: "{{ .FANTASMIC_API_KEY }}"
+        WISHES_API_KEY: "{{ .WISHES_API_KEY }}"
+  data:
+    - secretKey: DB_PASSWORD
+      remoteRef: { key: litellm, property: db-password }
+    - secretKey: SALT_KEY
+      remoteRef: { key: litellm, property: salt-key }
+    - secretKey: ILLUMINATIONS_API_KEY
+      remoteRef: { key: illuminations, property: api-key }
+    - secretKey: FANTASMIC_API_KEY
+      remoteRef: { key: fantasmic, property: api-key }
+    - secretKey: WISHES_API_KEY
+      remoteRef: { key: wishes, property: api-key }