Point Forgejo ClusterSecretStore at live coulombcore OpenBao

Use https://bao.coulomb.social with token auth until railiance01 OpenBao is
bootstrapped; the in-cluster railiance01 instance is not initialized.

argocd/platform-addons/openbao-secretstore/openbao-forgejo.clustersecretstore.yaml

@@ -1,3 +1,9 @@
+# Interim: Forgejo on railiance01 reads SMTP creds from coulombcore OpenBao
+# (https://bao.coulomb.social) until railiance01 OpenBao is bootstrapped (Wave 7).
+#
+# Prereq: Secret external-secrets/openbao-forgejo-eso-token (key: token) with a
+# policy-limited OpenBao token that can read platform/workloads/forgejo/forgejo-mailer.
+# Bootstrap: railiance-apps make forgejo-openbao-eso-token-apply
 apiVersion: external-secrets.io/v1beta1
 kind: ClusterSecretStore
 metadata:
@@ -8,16 +14,14 @@ metadata:
 spec:
   provider:
     vault:
-      server: http://openbao.openbao.svc.cluster.local:8200
+      server: https://bao.coulomb.social
       path: platform
       version: v2
       auth:
-        kubernetes:
+        tokenSecretRef:
-          mountPath: kubernetes
+          name: openbao-forgejo-eso-token
-          role: external-secrets-forgejo
+          namespace: external-secrets
-          serviceAccountRef:
+          key: token
-            name: external-secrets
-            namespace: external-secrets
   conditions:
     - namespaces:
         - forgejo