feat: add Redpanda and wp-deploy-coordinator to Legion

- Redpanda single-node StatefulSet in platform namespace
- wp-coordinator deployment consuming wp.deploy topic
- RBAC for coordinator to exec into harmonic-wordpress pods
- R2 credentials via ExternalSecret (no SSH key needed on coordinator)
- Sites config as ConfigMap — add new WP sites without code changes

servers/legion/k8s/wp-coordinator/external-secrets.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: wp-coordinator-secrets
+  namespace: platform
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: wp-coordinator-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: gitea_token
+      remoteRef:
+        key: secret/data/gitea
+        property: api_token
+    - secretKey: r2_access_key
+      remoteRef:
+        key: secret/data/r2
+        property: access_key_id
+    - secretKey: r2_secret_key
+      remoteRef:
+        key: secret/data/r2
+        property: secret_access_key