Add bolletjestrui app + vic.rubenhensen.nl

Deploys ghcr.io/rubenhensen/bolletjestrui at vic.rubenhensen.nl:
- bolletjestrui/ folder: deployment (SQLite on a PVC, migrate-on-start,
  ORIGIN + raised BODY_SIZE_LIMIT for GPX uploads), service, nginx
  ingress with prod-cluster-issuer TLS, PVC, and a Vault ExternalSecret
  (kv/bolletjestrui: site_password, admin_password, key_secret).
- apps/templates/bolletjestrui-folder.yaml: ArgoCD Application.
- dns: vic A record -> 46.224.26.65 (ingress LB).
- renovate: watch bolletjestrui/ for image tag bumps.

Committed locally, not pushed: needs the Vault secret created and the
ghcr package made public first.

bolletjestrui/external-secret.yaml

@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: bolletjestrui-secrets
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: bolletjestrui-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: site_password
+      remoteRef:
+        key: kv/bolletjestrui
+        property: site_password
+    - secretKey: admin_password
+      remoteRef:
+        key: kv/bolletjestrui
+        property: admin_password
+    - secretKey: key_secret
+      remoteRef:
+        key: kv/bolletjestrui
+        property: key_secret