Production deploy fails: ESO CRDs (ExternalSecret/SecretStore) missing in EKS cluster — automate operator install with Terraform

## Summary

The production deployment to EKS **fails at `helm upgrade --install`** before any manifest is applied:

```
Release "statuslist" does not exist. Installing it now.
Error: unable to build kubernetes objects from release manifest: [
resource mapping not found for name: "statuslist-external-secret" namespace: "statuslist-production" from "": no matches for kind "ExternalSecret" in version "external-secrets.io/v1"
resource mapping not found for name: "statuslist-external-secret-aws-credentials" namespace: "statuslist-production" from "": no matches for kind "ExternalSecret" in version "external-secrets.io/v1"
resource mapping not found for name: "statuslist-secret-store" namespace: "statuslist-production" from "": no matches for kind "SecretStore" in version "external-secrets.io/v1"
ensure CRDs are installed first
]
Error: Process completed with exit code 1.
```

## Root cause

This is an **infrastructure / cluster-prerequisite gap**, not a defect in this repository's chart.

The deploy workflow ([`deploy.yml`](.github/workflows/deploy.yml)) installs the chart with `-f helm/chart/values-aws.yaml`, which enables ESO mode:

```yaml
externalSecret.enabled: true
secretStore.enabled: true
statuslist.aws.mountCredentials: true # -> renders statuslist-external-secret-aws-credentials
```

With those enabled, the chart renders **External Secrets Operator (ESO) custom resources**:

| Resource | Chart template |
|---|---|
| `ExternalSecret` `statuslist-external-secret` | [`templates/external-secrets.yaml`](helm/chart/templates/external-secrets.yaml) |
| `ExternalSecret` `statuslist-external-secret-aws-credentials` | [`templates/external-secrets.yaml`](helm/chart/templates/external-secrets.yaml) |
| `SecretStore` `statuslist-secret-store` | [`templates/secret-store.yaml`](helm/chart/templates/secret-store.yaml) |

All use `apiVersion: external-secrets.io/v1`. Because the **External Secrets Operator is not installed** in the target cluster (`datev-wallet-cluster`, region `eu-central-1`, namespace `statuslist-production`), the cluster does not serve the `external-secrets.io/v1` API group, and Helm rejects the release with `no matches for kind ... / ensure CRDs are installed first`.

This is an explicitly-documented prerequisite:

- [`helm/README.md`](helm/README.md): *"External Secrets Operator (ESO) if you enable `externalSecret.enabled=true`. … the cluster CRDs must serve `external-secrets.io/v1` for `ExternalSecret`, `SecretStore`, and any `ClusterSecretStore` references **before installing or upgrading this chart**."*
- [`docs/deployment-runbook.md`](docs/deployment-runbook.md) (Mode B): *"To use ESO you must install External Secrets Operator in your cluster."*

The chart defaults (`values.yaml`) ship with `externalSecret.enabled: false` / `secretStore.enabled: false`) precisely so a cluster without ESO CRDs isn't rejected — the AWS overlay deliberately turns them on, so the operator must exist in the cluster.

## Where the fix belongs

Terraform / cluster-bootstrap IaC lives in a **separate repository**:

- **https://github.com/ADORSYS-GIS/wallet-eks-env** (private)

This repository (`adorsys/status-list-server`) contains no Terraform; the EKS cluster is provisioned and bootstrapped there.

## Required change (in `ADORSYS-GIS/wallet-eks-env`)

Provision the External Secrets Operator into the EKS cluster as part of cluster bootstrap, so its CRDs (`ExternalSecret`, `SecretStore`, `ClusterSecretStore` under `external-secrets.io/v1`) are present before the `statuslist` release is installed. Typical approach:

- Install the ESO Helm chart (e.g. `external-secrets/external-secrets`) via the Terraform `helm_release` / module used for the cluster, or
- Add the operator to the cluster GitOps/Argo CD application set if the cluster uses that pattern.

Also install the AWS auth path ESO needs (IRSA role + ServiceAccount for `statuslist-secret-store`) if not already provisioned.

## Acceptance criteria

- [ ] `kubectl get crd externalsecrets.external-secrets.io secretstores.external-secrets.io` (and `clustersecretstores...` if used) succeeds in `datev-wallet-cluster`.
- [ ] A fresh `helm upgrade --install statuslist ./helm/chart -f ./helm/chart/values-aws.yaml -f ./helm/chart/values-production.yaml` against `statuslist-production` succeeds past manifest mapping (no `no matches for kind ... external-secrets.io/v1`).
- [ ] The ExternalSecret(s) reconcile to `SecretSynced` and the app secret is available to the Deployment.

## Related

- Published operator: https://external-secrets.io/latest/
- Precedence guides already in-repo: `helm/README.md` ESO section, `docs/deployment-runbook.md` Mode B, `docs/troubleshooting.md` "Kubernetes & External Secrets Operator Issues".

## ETA
2days

Start with `.github/workflows/deploy.yml` to verify production deploy runs Helm with `values-aws.yaml` and thus renders ESO resources. Then inspect `helm/chart/templates/external-secrets.yaml`, `helm/chart/templates/secret-store.yaml`, and ESO prerequisite notes in `helm/README.md` and `docs/deployment-runbook.md`. The actual implementation is in `ADORSYS-GIS/wallet-eks-env` Terraform/bootstrap (installing `external-secrets/external-secrets` plus IRSA wiring), and done is CRD checks passing and `helm upgrade --install ... -f values-aws.yaml -f values-production.yaml` succeeding without `no matches for kind` errors.

由索引模型根據 Issue 內容生成。