feat: La Suite email/messages, buildkitd, monitoring, vault and storage updates

- Add Messages (email) service: backend, frontend, MTA in/out, MPA, SOCKS
  proxy, worker, DKIM config, and theme customization
- Add Collabora deployment for document collaboration
- Add Drive frontend nginx config and values
- Add buildkitd namespace for in-cluster container builds
- Add SeaweedFS remote sync and additional S3 buckets
- Update vault secrets across namespaces (devtools, lasuite, media,
  monitoring, ory, storage) with expanded credential management
- Update monitoring: rename grafana→metrics OAuth2Client, add Prometheus
  remote write and additional scrape configs
- Update local/production overlays with resource patches
- Remove stale login-ui resource patch from production overlay

base/lasuite/seaweedfs-buckets.yaml

@@ -30,10 +30,16 @@ spec:
                 sunbeam-conversations \
                 sunbeam-people \
                 sunbeam-git-lfs \
-                sunbeam-game-assets; do
+                sunbeam-game-assets \
+                sunbeam-ml-models; do
                 mc mb --ignore-existing "weed/$bucket"
                 echo "Ensured bucket: $bucket"
               done
+
+              # Enable object versioning on buckets that require it.
+              # Drive's WOPI GetFile response includes X-WOPI-ItemVersion from S3 VersionId.
+              mc versioning enable weed/sunbeam-drive
+              echo "Versioning enabled: sunbeam-drive"
           envFrom:
             - secretRef:
                 name: seaweedfs-s3-credentials