saggar(kube): deploy

Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0,
CI-published on the gitea saggar org, appVersion pinned to the image
commit) with the web UI. Engine on api.saggar.dev for the CLI and the
docker/apt registries, UI on saggar.dev — new cert, caddy route and
dns A record for the api host, TLS terminating at Caddy as usual.
Login via the home Gitea as an OIDC provider; private registry and
helm repo auth share one packages token.

kubernetes/kustomization.yaml

@@ -46,6 +46,7 @@ resources:
   - utilities/open-webui
   # Production (public-facing websites/apps)
   - production/buildpath
+  - production/saggar
   - production/semery-fr
   - production/umami
   - production/vhaudiquet-fr