Update External Secrets Helm chart 1.3.1 → 2.0.0 (#203)

## Summary
- Bump External Secrets Operator Helm chart from `helm-chart-1.3.1` to `helm-chart-2.0.0` (operator v1.3.2)
- Updates both the operator app and CRDs app `targetRevision`
- No Helm values changes needed — `installCRDs`, `resources`, `webhook`, `certController` keys are unchanged

## Breaking changes in chart 2.0.0
- **Removed providers:** Alibaba and Device42 (unmaintained) — does not affect our 1Password setup
- **Templating engine v1 deprecated** — our ExternalSecrets don't set `engineVersion`, so they use the default (v2)
- **Webhook `failurePolicy`** for SecretStore is now dynamic

## Deployment
1. Sync CRDs first: `argocd app set external-secrets-crds --revision update/external-secrets-helm-2.0.0 && argocd app sync external-secrets-crds`
2. Sync operator: `argocd app set external-secrets --revision update/external-secrets-helm-2.0.0 && argocd app sync external-secrets`
3. Verify: `kubectl --context=minikube-indri -n external-secrets get pods`
4. After merge, set both apps back to `--revision main`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/203

argocd/apps/external-secrets-crds.yaml

@@ -16,7 +16,7 @@ spec:
   project: default
   source:
     repoURL: ssh://forgejo@forge.ops.eblu.me:2222/eblume/external-secrets.git
-    targetRevision: helm-chart-1.3.1
+    targetRevision: helm-chart-2.0.0
     path: config/crds/bases
     directory:
       exclude: 'kustomization.yaml'

argocd/apps/external-secrets.yaml

@@ -15,7 +15,7 @@ spec:
   project: default
   sources:
     - repoURL: ssh://forgejo@forge.ops.eblu.me:2222/eblume/external-secrets.git
-      targetRevision: helm-chart-1.3.1
+      targetRevision: helm-chart-2.0.0
       path: deploy/charts/external-secrets
       helm:
         releaseName: external-secrets