feat(shelly-manager): wire Home Assistant onboarding (BaseUrl + admin token)

Enables the single-click HA onboarding shipped in shelly-manager PR #41:
shelly-manager registers a provisioned Shelly into HA's native integration
by driving HA's config-flow + device-registry API.

- shelly-manager-llat ExternalSecret projects the full-admin HA LLAT from
  OpenBao (apps/home-assistant/shelly-manager-llat, key 'token').
- HomeAssistant__BaseUrl = http://home-assistant (in-namespace svc :80 → nginx
  sidecar → HA :8123; nginx forwards the WS upgrade, so both the REST config-
  flow and the device-registry websocket work). Reachability confirmed: same-
  namespace ingress is allowed by the default-deny-ingress CNP's home-assistant
  rule (probed :80 → 401 = reachable).
- HomeAssistant__Token from the new secret.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kubernetes/apps/home-assistant/kustomization.yaml

@@ -24,6 +24,7 @@ resources:
   - shelly-manager-firmware-rbac.yaml
   - shelly-ble-proxy-key-externalsecret.yaml
   - shelly-manager-auth-externalsecret.yaml
+  - shelly-manager-llat-externalsecret.yaml
   - shelly-manager-deployment.yaml
   - shelly-manager-service.yaml
   - shelly-manager-gate-service.yaml

kubernetes/apps/home-assistant/shelly-manager-deployment.yaml

@@ -118,6 +118,20 @@ spec:
               value: X-authentik-username
             - name: Auth__ReverseProxy__TrustedProxies__0
               value: 10.244.0.0/16
+            # Home Assistant onboarding: single-click provisioning also registers
+            # the device in HA's native Shelly integration (with the admin
+            # password shelly-manager set) by driving HA's config-flow + device-
+            # registry WS API. BaseUrl is the in-namespace HA service (:80 → the
+            # nginx sidecar → HA :8123; nginx forwards the websocket upgrade, so
+            # both the config-flow REST and the device-registry WS work). Token is
+            # a full-admin HA LLAT from OpenBao (apps/home-assistant/shelly-manager-llat).
+            - name: HomeAssistant__BaseUrl
+              value: http://home-assistant
+            - name: HomeAssistant__Token
+              valueFrom:
+                secretKeyRef:
+                  name: shelly-manager-llat
+                  key: token
           volumeMounts:
             - name: data
               mountPath: /data

kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: shelly-manager-llat
+  namespace: home-assistant
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: shelly-manager-llat
+  # A Home Assistant admin long-lived access token. HA has no fine-grained
+  # tokens, so this is full-admin — shelly-manager uses it only to drive the
+  # config-flow API (create/verify/delete the Shelly entries it provisions).
+  dataFrom:
+    - extract:
+        key: apps/home-assistant/shelly-manager-llat