Move cluster config secrets from Secrets Manager to Parameter Store

**Parent:** #584
**Priority:** Medium

Currently cluster config is stored in AWS Secrets Manager (`{clusterName}/config`). Consider migrating to AWS Systems Manager Parameter Store:

**Advantages:**
- Lower cost (no per-secret pricing, free for standard parameters)
- Simpler API for key-value config that isn't truly secret
- Parameter Store supports hierarchical paths (`/{clusterName}/config`)
- Better suited for non-sensitive metadata (cluster ARN, region, VPC ID)

**What stays in Secrets Manager:**
- Keycloak passwords (`{clusterName}/keycloak`)
- Any actual secrets (tokens, credentials)

**Changes needed:**
- Update ClusterSecretStore to use Parameter Store provider
- Update ExternalSecret `dataFrom` to use Parameter Store
- Update Taskfile `secrets-manager:seed` to use `aws ssm put-parameter`
- Update PlatformCluster composition (if seeding is automated via #602)
- Update fleet-secret chart if key format changes
- Update destroy task cleanup commands

Start by reading the ClusterSecretStore, ExternalSecret dataFrom configuration, the Taskfile secrets-manager:seed target, the PlatformCluster composition, and the fleet-secret chart. Trace the current cluster-config and destroy cleanup flows before changing their provider references. Done means non-sensitive cluster config uses Parameter Store, actual secrets remain in Secrets Manager, and seed and cleanup paths are consistent.

Written by the indexing model from the issue text.