Add k8s DaemonSet design for RKE2 nodes (Model A, per-node self-contained)

Design artifact (NOT applied). Per-node pod = host-poller + redis + web sharing
pod localhost; only host-poller privileged with hostPath /dev+/sys. No SAS
poller (no enclosures). MQTT_NODE_ID from spec.nodeName; MQTT creds via VSO
VaultStaticSecret reading secret/home_assistant (mqtt_user/pass -> MQTT_USERNAME/
PASSWORD). nodeSelector jbod-monitor=enabled to pin to pascal/currie/fermi.

k8s/mqtt-vaultstaticsecret.yaml

@@ -0,0 +1,30 @@
+# MQTT broker creds for the web container, synced from OpenBao by VSO.
+#
+# Reads secret/home_assistant (keys mqtt_user / mqtt_pass) and renders a k8s
+# Secret `jbod-mqtt` with MQTT_USERNAME / MQTT_PASSWORD keys (consumed via
+# envFrom in the DaemonSet). VSO's `vso-read` policy can read secret/data/*,
+# so unlike the claude-read token it CAN read home_assistant — no creds ever
+# touch these manifests.
+#
+# Verify the transformation syntax against the installed VSO version.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: jbod-mqtt
+  namespace: jbod-monitor
+spec:
+  vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
+  mount: secret
+  type: kv-v2
+  path: home_assistant
+  refreshAfter: 1h
+  destination:
+    name: jbod-mqtt
+    create: true
+    transformation:
+      excludeRaw: true
+      templates:
+        MQTT_USERNAME:
+          text: '{{ .Secrets.mqtt_user }}'
+        MQTT_PASSWORD:
+          text: '{{ .Secrets.mqtt_pass }}'