feat(xui): add 3x-ui VPN panel behind cloudflared tunnel

VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.

vpn/xui/k8s/config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: xui-config
+  namespace: xui
+data:
+  XUI_DB_FOLDER: "/etc/x-ui"
+  XUI_ENABLE_FAIL2BAN: "false"
+  XUI_INIT_WEB_BASE_PATH: "/"
+  XUI_LOG_LEVEL: "warning"
+  XUI_PORT: "30379"