feat(devtools): deploy Penpot + MCP server, wildcard TLS via DNS-01

Penpot (designer.sunbeam.pt):
- Frontend/backend/exporter deployments with OIDC-only auth via Hydra
- VSO-managed DB, S3, and app secrets from OpenBao
- PostgreSQL user/db in CNPG postInitSQL
- Hydra Maester enabledNamespaces extended to devtools

Penpot MCP server (mcp-designer.sunbeam.pt):
- Pre-built Node.js image pushed to Gitea registry
- Auth-gated via Pingora auth_request → Hydra /userinfo
- WebSocket path for browser plugin connection

Wildcard TLS:
- Switched cert-manager from HTTP-01 (per-SAN) to DNS-01 via Scaleway webhook
- Certificate collapsed to *.sunbeam.pt + sunbeam.pt
- Added scaleway-certmanager-webhook Helm chart
- VSO secret for Scaleway DNS API credentials in cert-manager namespace
- Added cert-manager to OpenBao VSO auth role

scripts/local-seed-secrets.sh

@@ -58,7 +58,7 @@ done
 echo "==> Setting postgres user passwords..."
 PG_POD=$(kubectl $CTX -n data get pods -l cnpg.io/cluster=postgres,role=primary -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || echo "")
 if [[ -n "$PG_POD" ]]; then
-  for user in kratos hydra gitea hive docs meet drive messages conversations people find; do
+  for user in kratos hydra gitea hive docs meet drive messages conversations people find penpot; do
     kubectl $CTX -n data exec "$PG_POD" -c postgres -- \
       psql -U postgres -c "ALTER USER $user WITH PASSWORD '$DB_PASSWORD';" 2>/dev/null || true
   done
@@ -94,6 +94,16 @@ create_secret devtools gitea-s3-credentials \
   --from-literal=access-key="$S3_ACCESS_KEY" \
   --from-literal=secret-key="$S3_SECRET_KEY"
 
+create_secret devtools penpot-db-credentials \
+  --from-literal=password="$DB_PASSWORD"
+
+create_secret devtools penpot-s3-credentials \
+  --from-literal=access-key="$S3_ACCESS_KEY" \
+  --from-literal=secret-key="$S3_SECRET_KEY"
+
+create_secret devtools penpot-app-secrets \
+  --from-literal=secret-key="penpot-local-secret-key-not-for-production"
+
 # Storage namespace
 ensure_ns storage
 create_secret storage seaweedfs-s3-credentials \
@@ -181,6 +191,7 @@ else
       bao kv put secret/seaweedfs access-key='$S3_ACCESS_KEY' secret-key='$S3_SECRET_KEY'
       bao kv put secret/hive db-url='postgresql://hive:${DB_PASSWORD}@postgres-rw.data.svc.cluster.local:5432/hive_db' oidc-client-id='hive-local' oidc-client-secret='hive-local-secret'
       bao kv put secret/people db-password='$DB_PASSWORD' django-secret-key='local-dev-people-django-secret-key-not-for-production'
+      bao kv put secret/penpot db-password='$DB_PASSWORD' secret-key='penpot-local-secret-key-not-for-production'
       bao kv put secret/livekit api-key='$LIVEKIT_API_KEY' api-secret='$LIVEKIT_API_SECRET'
     " 2>/dev/null
     echo "    Done."