feat: scaffold Flux manifests for zip-enrichment, holidays, air-quality API services

Closes leeworks-agents/api-company#46

Add flux/ directories for all three API services, each containing:
- namespace.yaml — Kubernetes Namespace
- helmrelease.yaml — HelmRelease using bedag/raw chart with Deployment,
  Service, and Ingress (TLS via cert-manager letsencrypt-prod)
- externalsecret.yaml — placeholder/comment for RapidAPI proxy-secret;
  includes kubectl manual-create instructions until ESO is deployed
- kustomization.yaml — per-directory Kustomize resources list

Services and subdomains:
  zip-enrichment  → zip.leeworks.dev
  holidays        → holidays.leeworks.dev
  air-quality     → aqi.leeworks.dev

Images:
  registry.leeworks.dev/zip-enrichment/server:latest
  registry.leeworks.dev/holidays/server:latest
  registry.leeworks.dev/air-quality/server:latest

Update root flux/kustomization.yaml to include all three new directories.
kustomize build flux/ passes with zero errors.

flux/zip-enrichment/externalsecret.yaml

@@ -0,0 +1,29 @@
+# Placeholder: inject the RapidAPI Proxy Secret here once ESO is deployed.
+# Replace with a real ExternalSecret once leeworks-agents/api-company#2 and
+# the external-secrets operator are running in the cluster.
+#
+# Example (uncomment and fill in secretStore name):
+#
+# apiVersion: external-secrets.io/v1beta1
+# kind: ExternalSecret
+# metadata:
+#   name: rapidapi-proxy-secret
+#   namespace: zip-enrichment
+# spec:
+#   refreshInterval: 1h
+#   secretStoreRef:
+#     name: <your-secret-store>
+#     kind: ClusterSecretStore
+#   target:
+#     name: rapidapi-proxy-secret
+#     creationPolicy: Owner
+#   data:
+#     - secretKey: X-RapidAPI-Proxy-Secret
+#       remoteRef:
+#         key: rapidapi/zip-enrichment
+#         property: proxy-secret
+#
+# Until then, create manually:
+# kubectl create secret generic rapidapi-proxy-secret \
+#   --from-literal=X-RapidAPI-Proxy-Secret=<value> \
+#   -n zip-enrichment