Patches gitea admin credentials into secret/sol for Sol's Gitea integration. Adds sol-agent vault policy with read/write access to sol-tokens/* for user impersonation PATs, plus k8s auth role bound to the matrix namespace.
Split images.rs (1809L) into mod.rs + builders.rs (per-service build functions). Split secrets.rs (1727L) into mod.rs + seeding.rs (KV get_or_create, seed_openbao) + db_engine.rs (PostgreSQL static roles). Moves BuildTarget enum from cli.rs into images/mod.rs with conditional clap::ValueEnum derive behind the "cli" feature.
