Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/onepassword-connect/cluster-secret-store.yaml

@@ -24,6 +24,7 @@ spec:
       connectHost: http://onepassword-connect.onepassword-connect.svc.cluster.local:8080
       vaults:
         mk-labs: 1          # vault name in 1Password : priority
+        wdw-labs: 2         # WDW Labs hosts/agents (LiteLLM, host api-keys); Connect token needs read access
       auth:
         secretRef:
           connectTokenSecretRef: