feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates

- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
  proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
  monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
  remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay

base/devtools/vault-secrets.yaml

@@ -24,7 +24,7 @@ spec:
   allowStaticCreds: true
   refreshAfter: 5m
   rolloutRestartTargets:
-    - kind: StatefulSet
+    - kind: Deployment
       name: gitea
   destination:
     name: gitea-db-credentials
@@ -47,6 +47,9 @@ spec:
   type: kv-v2
   path: seaweedfs
   refreshAfter: 30s
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: gitea
   destination:
     name: gitea-s3-credentials
     create: true
@@ -70,6 +73,9 @@ spec:
   type: kv-v2
   path: gitea
   refreshAfter: 30s
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: gitea
   destination:
     name: gitea-admin-credentials
     create: true