feat: deploy External Secrets Operator (ESO) via Flux + real ExternalSecrets

Add flux/external-secrets/ directory containing:
- namespace.yaml: external-secrets namespace
- helmrepository.yaml: charts.external-secrets.io HelmRepository
- helmrelease.yaml: ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0)
- clustersecretstore.yaml: ClusterSecretStore using Kubernetes provider
  (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore)
- kustomization.yaml: wires all above resources

Uncomment and complete ExternalSecret manifests in each API namespace:
- flux/zip-enrichment/externalsecret.yaml
- flux/holidays/externalsecret.yaml
- flux/air-quality/externalsecret.yaml

All three ExternalSecrets reference the kubernetes-provider ClusterSecretStore
and will auto-sync rapidapi-proxy-secret once ESO is running.

Add external-secrets to flux/kustomization.yaml.

kustomize build flux/ = PASS

Closes leeworks-agents/api-company#61

flux/external-secrets/clustersecretstore.yaml

@@ -0,0 +1,50 @@
+# ClusterSecretStore using the Kubernetes provider.
+# Reads secrets from the cluster itself — no external vault required.
+# The service account below must have get/list access to secrets in
+# the namespaces where ExternalSecrets are created.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eso-kubernetes-provider
+  namespace: external-secrets
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: eso-kubernetes-provider-reader
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eso-kubernetes-provider-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eso-kubernetes-provider-reader
+subjects:
+  - kind: ServiceAccount
+    name: eso-kubernetes-provider
+    namespace: external-secrets
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: kubernetes-provider
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: external-secrets
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          namespace: external-secrets
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: eso-kubernetes-provider
+          namespace: external-secrets