feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates

- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
  proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
  monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
  remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay

base/lasuite/messages-mpa-deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: messages-mpa
+  namespace: lasuite
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: messages-mpa
+  template:
+    metadata:
+      labels:
+        app: messages-mpa
+    spec:
+      containers:
+        - name: messages-mpa
+          image: messages-mpa
+          ports:
+            - containerPort: 8010
+          env:
+            - name: RSPAMD_password
+              valueFrom:
+                secretKeyRef:
+                  name: messages-mpa-credentials
+                  key: RSPAMD_password
+            - name: PORT
+              value: "8010"
+            - name: REDIS_HOST
+              value: valkey.data.svc.cluster.local
+            - name: REDIS_PORT
+              value: "6379"
+          volumeMounts:
+            - name: dkim-key
+              mountPath: /etc/rspamd/dkim
+              readOnly: true
+            - name: dkim-signing-conf
+              mountPath: /etc/rspamd/local.d
+              readOnly: true
+          resources:
+            limits:
+              memory: 768Mi
+              cpu: 250m
+            requests:
+              memory: 256Mi
+              cpu: 50m
+      volumes:
+        - name: dkim-key
+          secret:
+            secretName: messages-dkim-key
+            items:
+              - key: dkim-private-key
+                path: default.sunbeam.pt.key
+        - name: dkim-signing-conf
+          configMap:
+            name: messages-mpa-rspamd-config