feat: add Listmonk newsletter platform on Legion k3s

- Namespace, ExternalSecrets (Vault), DB init job, deployment, service, PVC, ingress
- Routes newsletter.harmonic-framework.com via existing Cloudflare tunnel
- Uses shared platform postgres with dedicated listmonk DB/user
- Credentials stored at secret/data/listmonk in Vault

servers/legion/k8s/listmonk/external-secrets.yaml

@@ -0,0 +1,56 @@
+---
+# listmonk-secrets — DB credentials and admin password from Vault
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: listmonk-secrets
+  namespace: listmonk
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: listmonk-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: db_password
+      remoteRef:
+        key: secret/data/listmonk
+        property: db_password
+    - secretKey: db_user
+      remoteRef:
+        key: secret/data/listmonk
+        property: db_user
+    - secretKey: db_name
+      remoteRef:
+        key: secret/data/listmonk
+        property: db_name
+    - secretKey: admin_password
+      remoteRef:
+        key: secret/data/listmonk
+        property: admin_password
+    - secretKey: app_key
+      remoteRef:
+        key: secret/data/listmonk
+        property: app_key
+---
+# postgres superuser password — needed for DB init job
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: postgres-superuser
+  namespace: listmonk
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: postgres-superuser
+    creationPolicy: Owner
+  data:
+    - secretKey: password
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password