Everything-is-an-app cutover: Storage & Database group (harbor, gitea, loki, kubeflow-pipelines)

## Parent

linode/apl-core#3515

## What to build

Cut the **Storage & Database** group of core apps over to the new git-driven layout. These apps are grouped because they share the same cross-cutting managed settings beyond the universal four: object storage buckets (`obj.*`) and CNPG-backed databases (`databases.*`).

Apps in this batch:
- `harbor`
- `gitea`
- `loki`
- `kubeflow-pipelines`

Note: `harbor` and `gitea` are also OIDC consumers — coordinate their OIDC managed-values wiring with the SSO/OIDC batch (they must emit both `obj`/`databases` and OIDC references into `values.managed.yaml`).

End-to-end behavior per app: `enabled` in `env/settings/apps.yaml`; vendor-shaped `values.custom.yaml` + operator-rendered `values.managed.yaml` under `env/values///`; multi-source `Application` CR file; legacy `env/apps/.yaml` + inline-values path removed. Storage/DB credentials appear only as Secret references — value files stay secret-free.

## Acceptance criteria

- [ ] Each app reconciles Healthy in ArgoCD from its `env/values///{managed,custom}.yaml`.
- [ ] `obj` bucket + CNPG database wiring emitted into `values.managed.yaml`; credentials only as Secret references.
- [ ] harbor/gitea also emit OIDC references (cross-dependency with the SSO/OIDC batch noted and handled).
- [ ] Legacy `env/apps/.yaml` entries and inline-values path removed for this batch.
- [ ] Existing `installed:` gating still works from `env/settings/apps.yaml`.

## Blocked by

- linode/apl-core#3571
- linode/apl-core#3572
- linode/apl-core#3573

Start by reading the parent issue and blockers, then inspect env/settings/apps.yaml, the existing env/apps/.yaml files, and env/values///. Compare a migrated app's multi-source Application CR and managed/custom values with the four target apps. Done means all four reconcile Healthy in ArgoCD, preserve installed gating, emit storage/database and required OIDC references without secret values, and have their legacy entries removed.

Written by the indexing model from the issue text.