fix(minio): rewrite Tenant to operator-v5 schema, single-node pool, declarative buckets/users — removes invalid Bucket/Policy/User CRs and dead multi-site replication

Old Tenant used unknown v2 fields (pools[].size/storageClass, spec.console/metrics/ingress)
and referenced nonexistent minio.min.io/v1alpha1 Bucket/Policy/User kinds, so the app
never synced. Rewrites to valid v2: single erasure-coded pool (4 vols) pinned to
talos-cp-1/az-a (only schedulable+Longhorn node per 3-CP topology), spec.buckets +
spec.users declarative provisioning, prometheusOperator ServiceMonitor, features.domains.
Drops hand-rolled minio-service (operator owns it), dead multi-site replication job,
and legacy alias. Adds mc-based PostSync job for the ollama scoped policy, and
SOPS-encrypted minio-creds/oidc/user secrets for IaC record.

k8s/infrastructure/minio/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 namespace: storage
 resources:
   - minio-tenant.yaml
-  - minio-service.yaml
-  - minio-replication-job.yaml
-  - buckets.yaml
-# Legacy: minio-legacy-alias.yaml skipped (migration artifact, conflicts with namespace transform)
+  - minio-policy-job.yaml
+# The operator creates the minio S3/console/headless Services and the
+# declarative bucket + user from the Tenant spec — no hand-rolled Service or
+# Bucket/User CRs (those kinds don't exist in the operator CRD set).