Automate spoke cluster Secrets Manager seeding via Crossplane composition

**Parent:** #584
**Priority:** High

The PlatformCluster composition should create the Secrets Manager entry as part of cluster provisioning. Currently this is a manual step after the EKS cluster is ready.

The composition already has the ARN, VPC ID, and region. Add a Secrets Manager Secret resource to the composition that creates `{clusterName}/config` with:
- `server`: cluster ARN
- `config`: `{"tlsClientConfig":{"insecure":false}}`
- `metadata`: JSON with `aws_region`, `aws_cluster_name`, `aws_vpc_id`, repo URLs, and other annotations

This eliminates the manual seeding step and makes spoke provisioning fully GitOps-driven:
1. Add cluster to `fleet/kro-values/tenants/{tenant}/kro-clusters/values.yaml`
2. Add fleet member to `fleet/members/{name}/values.yaml`
3. Add environment `overlays/environments/{env}/enabled-addons.yaml`
4. Commit and push — Crossplane provisions cluster, seeds secret, ExternalSecret creates ArgoCD cluster secret, addons deploy

**Challenges:**
- Secrets Manager secret value is a JSON string containing nested JSON — composition patching may be complex
- The metadata JSON includes repo URLs and basepath which come from the hub cluster secret, not the composition
- Need to handle the hub cluster differently (seed secret created by Taskfile, not composition)

Start with the PlatformCluster composition and the provisioning flow described in fleet/kro-values/tenants/{tenant}/kro-clusters/values.yaml, fleet/members/{name}/values.yaml, and overlays/environments/{env}/enabled-addons.yaml. Trace how the ARN, VPC ID, region, hub secret metadata, and nested JSON values are available; done means spoke provisioning creates {clusterName}/config for ExternalSecret consumption while the hub continues using Taskfile seeding.

Written by the indexing model from the issue text.