feat: export all K8 Plus cluster manifests

Namespaces: argocd, authentik, backup-system, cloudflare-ddns,
gitea, homarr, monitoring, n8n, openclaw, polymarket-bot, vaultwarden
Cluster-wide: clusterissuers, namespaces
Secrets: redacted (structure only, data=REDACTED)

default/secret-wildcard-chemavx-xyz-tls.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+data:
+  tls.crt: REDACTED
+  tls.key: REDACTED
+kind: Secret
+metadata:
+  annotations:
+    cert-manager.io/alt-names: '*.chemavx.xyz,chemavx.xyz'
+    cert-manager.io/certificate-name: wildcard-chemavx-xyz
+    cert-manager.io/common-name: chemavx.xyz
+    cert-manager.io/ip-sans: ''
+    cert-manager.io/issuer-group: ''
+    cert-manager.io/issuer-kind: ClusterIssuer
+    cert-manager.io/issuer-name: letsencrypt-prod
+    cert-manager.io/uri-sans: ''
+  labels:
+    controller.cert-manager.io/fao: 'true'
+  name: wildcard-chemavx-xyz-tls
+  namespace: default
+type: kubernetes.io/tls
+

default/service-kubernetes.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    component: apiserver
+    provider: kubernetes
+  name: kubernetes
+  namespace: default
+spec:
+  clusterIP: 10.43.0.1
+  clusterIPs:
+  - 10.43.0.1
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 6443
+  sessionAffinity: None
+  type: ClusterIP
+