feat(apps): restructure apps deployment, add Penpot HelmRelease, and refactor CDN ingress

.env.sample

@@ -12,3 +12,6 @@ GITEA_ACTIONS_TOKEN=placeholder
 # Flux Operator Web OIDC 凭据（Gitea 启动后创建 OAuth2 应用获取，Redirect URI: https://cd.dev.cm/oauth2/callback）
 FLUX_WEB_OIDC_CLIENT_ID=placeholder
 FLUX_WEB_OIDC_CLIENT_SECRET=placeholder
+
+# Penpot 凭据
+PENPOT_API_SECRET_KEY=placeholder