vault: point External Secrets at the in-cluster Vault service

The store went through https://vault.rubenhensen.nl, so via Hetzner and
the home internet connection. When home internet dropped, the store
validation failed and External Secrets backed off long enough that it
needed a controller restart after the connection came back.

vault-active.vault.svc talks to the active Vault pod directly. It's plain
HTTP, same as the ingress → Vault hop already is.

vault/secret-store.yaml

@@ -5,7 +5,9 @@ metadata:
 spec:
   provider:
     vault:
-      server: "https://vault.rubenhensen.nl"
+      # In-cluster, so syncing secrets doesn't depend on Hetzner or the home
+      # internet connection. Plain HTTP, like the ingress → Vault hop.
+      server: "http://vault-active.vault.svc:8200"
       path: "kv"
       # Version is the Vault KV secret engine version.
       # This can be either "v1" or "v2", defaults to "v2"