Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/external-dns/values.yaml

@@ -16,8 +16,6 @@ env:
     value: "10.1.71.32"
   - name: EXTERNAL_DNS_RFC2136_PORT
     value: "53"
-  - name: EXTERNAL_DNS_RFC2136_ZONE
-    value: "local.mk-labs.cloud"
   - name: EXTERNAL_DNS_RFC2136_TSIG_AXFR
     value: "true"
   # TSIG secret key name — must match what's configured in Technitium
@@ -34,6 +32,14 @@ env:
 # Only manage records in this zone
 domainFilters:
   - local.mk-labs.cloud
+  - wdw-labs.cloud
+
+# Multiple Technitium zones (the env var form only supports one zone).
+# wdw-labs.cloud zone must exist in Technitium and the "external-dns" TSIG key
+# must be authorised for dynamic updates + zone transfer on it (added for skyliner).
+extraArgs:
+  - --rfc2136-zone=local.mk-labs.cloud
+  - --rfc2136-zone=wdw-labs.cloud
 
 # Sources: ingress, service, and Gateway API HTTPRoutes
 sources: