RPF-WP-0046: periodic ESO database tokens and a daily renewer

The five dynamic-database ClusterSecretStores use 768h static tokens that
nothing renews; expiry revoked their DB leases on 2026-09-23 and recurs
around 2026-10-25. Kubernetes auth is not a drop-in fix: ESO v0.16.1 revokes
its login token after each reconcile, which revokes the leases it created.

- eso-token-renewer CronJob (ArgoCD draft, no RBAC, mounted Secrets).
- Attended periodic mint script for all five lanes.
- CronJob added to the platform-addons AppProject in git (not yet applied).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

argocd/railiance01/drafts/eso-token-renewer.application.yaml

@@ -0,0 +1,27 @@
+# DRAFT for railiance01 (RPF-WP-0046-T04). Not synced by any root: move to
+# ../applications/ only in T04, with the founder's go-ahead, after the
+# platform-addons AppProject carries batch/CronJob. No automated sync, no
+# finalizer. Set targetRevision to the reviewed commit at adoption.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: eso-token-renewer
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: railiance-platform-addons
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: PIN-AT-ADOPTION
+    path: argocd/platform-addons/eso-token-renewer
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    syncOptions:
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true