feat: deploy External Secrets Operator (ESO) via Flux + real ExternalSecrets

Add flux/external-secrets/ directory containing:
- namespace.yaml: external-secrets namespace
- helmrepository.yaml: charts.external-secrets.io HelmRepository
- helmrelease.yaml: ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0)
- clustersecretstore.yaml: ClusterSecretStore using Kubernetes provider
  (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore)
- kustomization.yaml: wires all above resources

Uncomment and complete ExternalSecret manifests in each API namespace:
- flux/zip-enrichment/externalsecret.yaml
- flux/holidays/externalsecret.yaml
- flux/air-quality/externalsecret.yaml

All three ExternalSecrets reference the kubernetes-provider ClusterSecretStore
and will auto-sync rapidapi-proxy-secret once ESO is running.

Add external-secrets to flux/kustomization.yaml.

kustomize build flux/ = PASS

Closes leeworks-agents/api-company#61

flux/air-quality/externalsecret.yaml

@@ -1,29 +1,18 @@
-# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
-# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
-# the external-secrets operator are running in the cluster.
-#
-# Example (uncomment and fill in secretStore name):
-#
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: rapidapi-proxy-secret
-#   namespace: air-quality
-# spec:
-#   refreshInterval: 1h
-#   secretStoreRef:
-#     name: <your-secret-store>
-#     kind: ClusterSecretStore
-#   target:
-#     name: rapidapi-proxy-secret
-#     creationPolicy: Owner
-#   data:
-#     - secretKey: X-RapidAPI-Proxy-Secret
-#       remoteRef:
-#         key: rapidapi/air-quality
-#         property: proxy-secret
-#
-# Until then, create manually:
-# kubectl create secret generic rapidapi-proxy-secret \
-#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
-#   -n air-quality
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: rapidapi-proxy-secret
+  namespace: air-quality
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: kubernetes-provider
+    kind: ClusterSecretStore
+  target:
+    name: rapidapi-proxy-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: X-RapidAPI-Proxy-Secret
+      remoteRef:
+        key: rapidapi-air-quality-source
+        property: X-RapidAPI-Proxy-Secret