REFACTOR(apps): migrate to app-template

- docusaurus: Replace with app-template, configmap in manifests/
- homer: Replace with app-template, configMapGenerator for config.yml
- crafty: Replace with app-template, pvc/ingress/service in manifests/
- mas: Replace with app-template, rbac/external-secret in manifests/
- All apps use app-template chart v3.6.1

mas/manifests/external-secret.yaml

@@ -0,0 +1,35 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mas-api-keys
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: mas-api-keys
+    creationPolicy: Owner
+  data:
+  - secretKey: anthropic-api-key
+    remoteRef:
+      key: mas/api-keys
+      property: ANTHROPIC_API_KEY
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgresql-password
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: postgresql-password
+    creationPolicy: Owner
+  data:
+  - secretKey: password
+    remoteRef:
+      key: databases/postgresql
+      property: PASSWORD

mas/manifests/rbac.yaml

@@ -0,0 +1,109 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mas
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mas-viewer
+rules:
+- apiGroups: [""]
+  resources:
+  - pods
+  - pods/log
+  - services
+  - endpoints
+  - namespaces
+  - nodes
+  - persistentvolumeclaims
+  - configmaps
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["apps"]
+  resources:
+  - deployments
+  - statefulsets
+  - daemonsets
+  - replicasets
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["batch"]
+  resources:
+  - jobs
+  - cronjobs
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["networking.k8s.io"]
+  resources:
+  - ingresses
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["argoproj.io"]
+  resources:
+  - applications
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources:
+  - pods/status
+  - services/status
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mas-viewer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mas-viewer
+subjects:
+- kind: ServiceAccount
+  name: mas
+  namespace: mas
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mas-writer
+rules:
+- apiGroups: [""]
+  resources:
+  - pods
+  - services
+  - configmaps
+  - secrets
+  verbs: ["create", "update", "patch", "delete"]
+- apiGroups: ["apps"]
+  resources:
+  - deployments
+  - statefulsets
+  - daemonsets
+  - replicasets
+  verbs: ["create", "update", "patch", "delete"]
+- apiGroups: ["networking.k8s.io"]
+  resources:
+  - ingresses
+  verbs: ["create", "update", "patch", "delete"]
+- apiGroups: ["batch"]
+  resources:
+  - jobs
+  - cronjobs
+  verbs: ["create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources:
+  - namespaces
+  verbs: ["create", "update", "patch"]
+- apiGroups: ["argoproj.io"]
+  resources:
+  - applications
+  verbs: ["create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mas-writer-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mas-writer
+subjects:
+- kind: ServiceAccount
+  name: mas
+  namespace: mas