feat(apps): restructure apps deployment, add Penpot HelmRelease, and refactor CDN ingress

flux/apps/secrets/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespaces.yaml
+  - penpot.yaml

flux/apps/secrets/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: apps

flux/apps/secrets/penpot.yaml

@@ -0,0 +1,10 @@
+# Penpot runtime secrets
+apiVersion: v1
+kind: Secret
+metadata:
+  name: penpot
+  namespace: apps
+type: Opaque
+stringData:
+  api-secret-key: |-
+    ${PENPOT_API_SECRET_KEY}