feat: Enable remaining addons for workshop parity (feature/cloudfront-exposure)

## Context

The `feature/cloudfront-exposure` branch has 16/49 addons enabled on the hub cluster. To reach parity with the main branch (`hub-config.yaml`), 15 additional addons need to be enabled and configured for the cloudfront exposure mode.

EKS Capabilities (ArgoCD, KRO, ACK) replace the corresponding Helm-based addons — those are intentionally disabled.

## Current State

**Enabled (16):** metrics_server, ingress_class_alb, aws_load_balancer_controller, external_secrets, external_dns, argo_workflows, keycloak, grafana_operator, grafana_dashboards, kube_state_metrics, prometheus_node_exporter, crossplane, platform_manifests, backstage, aws_resources, observability_aws

**Not needed (EKS Capabilities):** argocd, kro, ack_iam, ack_eks, ack_ec2, ack_ecr, ack_s3, ack_dynamodb, ack_efs

**Not needed (cloudfront mode replaces):** ingress_nginx

## Missing Addons (grouped by layer)

### Platform (tracked in sub-issue)
- [ ] `gitlab` — scaffolder backend, code repos (#698)
- [ ] `crossplane_aws` — AWS provider for spoke cluster provisioning
- [ ] `kro_manifests_hub` — ResourceGraphDefinitions for Backstage self-service templates
- [ ] `platform_manifests_hub` — hub-specific platform manifests
- [ ] `multi_acct` — multi-account IAM setup
- [ ] `kubevela` — app delivery (used by S3 ACK+KubeVela template)
- [ ] `devlake` — DORA metrics dashboard
- [ ] `image_prepuller` — pre-pull large images for faster pod starts
- [ ] `cert_manager` — internal TLS, webhook certificates

### GitOps (tracked in sub-issue)
- [ ] `argo_events` — event-driven workflow triggers
- [ ] `argo_rollouts` — progressive delivery (canary, blue-green)
- [ ] `kargo` — promotion pipelines across environments

### ML/AI (tracked in sub-issue)
- [ ] `jupyterhub` — interactive notebooks
- [ ] `ray_operator` — distributed compute
- [ ] `spark_operator` — Spark job execution

## Considerations for CloudFront Mode

Each addon with an ingress needs:
1. Path-based routing (no host header)
2. `alb.ingress.kubernetes.io/transforms.` annotation if the app doesn't serve at its path prefix natively
3. HTTP:80 listener (CloudFront terminates TLS)
4. Conditional rendering in ingress template (`exposure_mode` check)

Addons affected: `gitlab`, `devlake`, `jupyterhub`, `kubeflow`, `grafana`

## Sub-Issues

- [ ] #698 — GitLab + Backstage catalog integration
- [x] #700 — Platform layer addons
- [x] #701 — GitOps layer addons
- [x] #702 — ML/AI layer addons

## References

- Main branch `hub-config.yaml`: source of truth for addon enablement
- #690 — CloudFront exposure mode
- #574 — Multi-repo values overlay architecture

Start with the main branch hub-config.yaml and compare it with the feature/cloudfront-exposure branch to identify the remaining addon configuration. Review the ingress template for the listed CloudFront-affected addons and the related sub-issues #698, #700, #701, and #702. Done means the remaining addons are enabled and configured with the required path-based, HTTP:80 CloudFront behavior.

Written by the indexing model from the issue text.