feat(cli): add solo-provisioner eso command family for External Secret Operator management

## Context

`alloy cluster install` supports forwarding metrics and logs to remote Prometheus/Loki endpoints. Each remote requires a password stored in K8s Secret `grafana-alloy-secrets` (in the Alloy namespace) under conventional keys:

```
PROMETHEUS_PASSWORD_ # one per --add-prometheus-remote
LOKI_PASSWORD_ # one per --add-loki-remote
```

Today the user must create this secret manually (`kubectl create secret generic ...`). The preferred managed approach is [External Secrets Operator (ESO)](https://external-secrets.io/), which syncs secrets from an external store (Vault, AWS Secrets Manager, GCP Secret Manager, …) into K8s Secrets automatically.

The `alloy cluster install` help text already references `solo-provisioner eso secret create` as the recommended way to provision this secret, but the `eso` command family does not exist yet.

---

## Proposed command tree

```
solo-provisioner eso
├── operator
│ ├── install # Install the ESO Helm chart into the cluster
│ └── uninstall # Uninstall the ESO Helm chart
└── secret
├── create # Apply an ExternalSecret resource that syncs into a K8s Secret
└── delete # Delete the ExternalSecret (and optionally the synced K8s Secret)
```

---

## Sub-issues

- [ ] #670 — `eso operator install`
- [ ] #671 — `eso operator uninstall`
- [ ] #672 — `eso secret create`
- [ ] #673 — `eso secret delete`
- [ ] #883 — align `eso operator` workflow with conventions (preflight cluster gate + error-control flags)
- [ ] #894 — pin ESO version via catalog and remove `--chart-version` from `eso operator install`

---

## Example: full Alloy-with-remotes workflow

```bash
# Step 1: Install the ESO operator (once per cluster)
solo-provisioner eso operator install

# Step 2: Create the ExternalSecret that syncs passwords into grafana-alloy-secrets
solo-provisioner eso secret create \
--store=vault-store \
--name=grafana-alloy-secrets \
--namespace=grafana-alloy \
--set PROMETHEUS_PASSWORD_PRIMARY=secret/data/grafana/alloy/prod/prometheus/primary#password \
--set LOKI_PASSWORD_PRIMARY=secret/data/grafana/alloy/prod/loki/primary#password

# Step 3: Install Alloy — it reads passwords from the synced secret
solo-provisioner alloy cluster install \
--cluster-name=my-cluster \
--add-prometheus-remote=name=primary,url=https://prom.example.com/api/v1/write,username=user1 \
--add-loki-remote=name=primary,url=https://loki.example.com/loki/api/v1/push,username=user1
```

---

> **Prerequisite:** A `ClusterSecretStore` must already exist in the cluster and point to the team's secrets backend. Setting up `ClusterSecretStore` is out of scope for this issue — it is cluster-operator configuration that varies by environment (Vault auth method, AWS IAM role, etc.).