feat(velero): Argo app + Helm values for Kopia/Hetzner S3 backups (DEV-572)

- apps/app-velero.yaml: Argo Application, path apps/velero, ns velero,
  CreateNamespace + ServerSideApply (chart uses long CRDs).
- apps/velero/Chart.yaml: pinned vmware-tanzu velero chart 12.1.0
  (appVersion 1.18.1).
- apps/velero/values.yaml: Kopia uploader, no CSI, node-agent enabled,
  AWS S3 provider -> https://hel1.your-objectstorage.com, dedicated
  bucket basicstack-velero (per DEV-570), BSL credential
  velero-s3-credentials/cloud, Kopia repo password auto-picked from
  velero-repo-credentials/repository-password.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/app-velero.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: velero
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git
+    targetRevision: main
+    path: apps/velero
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: velero
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+    - ServerSideApply=true

apps/velero/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: velero
+description: Velero cluster-reconstruction backups for BasicStack (Kopia + Hetzner S3)
+type: application
+version: 1.0.0
+appVersion: "1.18.1"
+
+dependencies:
+  - name: velero
+    version: 12.1.0
+    repository: https://vmware-tanzu.github.io/helm-charts

apps/velero/values.yaml

@@ -0,0 +1,101 @@
+velero:
+  # Pinned chart version 12.1.0 (Velero appVersion 1.18.1).
+  # AWS plugin follows Velero minor version: v1.14.x for Velero 1.18.x.
+  image:
+    repository: velero/velero
+    tag: v1.18.1
+    pullPolicy: IfNotPresent
+
+  # Bring the AWS object-storage plugin in as an initContainer that copies
+  # the binary into /plugins so the Velero server can load it.
+  initContainers:
+    - name: velero-plugin-for-aws
+      image: velero/velero-plugin-for-aws:v1.14.3
+      imagePullPolicy: IfNotPresent
+      volumeMounts:
+        - mountPath: /target
+          name: plugins
+
+  # Kopia file-system backup requires the node-agent daemonset on every
+  # node whose PVC data we back up.
+  deployNodeAgent: true
+
+  # BackupStorageLocation credentials come from the SealedSecret
+  # apps/velero/velero-s3-credentials-sealed.yaml (key: cloud, INI format
+  # with aws_access_key_id / aws_secret_access_key for the dedicated
+  # `velero-prod` Hetzner OS credential from DEV-570).
+  credentials:
+    useSecret: true
+    existingSecret: velero-s3-credentials
+
+  # Kopia backup-repository password (velero-repo-credentials Secret,
+  # key `repository-password`) is auto-discovered by Velero — this is a
+  # hard-coded constant in the Velero server (see pkg/repository/keys),
+  # so no extra wiring is needed. SealedSecret lives at
+  # apps/velero/velero-repo-credentials-sealed.yaml.
+
+  # Turn OFF volume-snapshot CRDs — Hetzner Cloud Volumes have no CSI
+  # snapshot support, so filesystem backup via Kopia is the only path.
+  snapshotsEnabled: false
+  backupsEnabled: true
+
+  configuration:
+    # Kopia uploader (unified repo). This is the Velero server default in
+    # 1.18 but we set it explicitly so any future default change does not
+    # silently rewrite our repos to restic.
+    uploaderType: kopia
+
+    # No CSI feature flag — see snapshotsEnabled comment above.
+    features: ""
+
+    backupStorageLocation:
+      - name: default
+        provider: aws
+        bucket: basicstack-velero
+        default: true
+        credential:
+          name: velero-s3-credentials
+          key: cloud
+        config:
+          # Hetzner Object Storage in Helsinki (hel1). Region is used by
+          # the AWS SDK signer; endpoint overrides the AWS endpoint URL.
+          region: hel1
+          s3ForcePathStyle: "false"
+          s3Url: https://hel1.your-objectstorage.com
+          # publicUrl left unset — this backend is not user-facing.
+
+    # No volumeSnapshotLocation entries — snapshotsEnabled: false above
+    # already suppresses the default snapshot location CRD.
+
+  # Small resource footprint until we know real backup sizing (DEV-573).
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+  nodeAgent:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 1000m
+        memory: 1Gi
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: false
+
+  # Do not install the bundled `velero` CLI kubectl image — we run the
+  # CLI from cp-1.
+  kubectl:
+    image:
+      repository: bitnami/kubectl
+    resources: {}
+
+  # No schedules here — those live in DEV-573.
+  schedules: {}