Separate GitLab-specific credentials from peeks-hub/secrets into peeks-hub/gitlab

[allamand]

Problem

peeks-hub/secrets currently mixes platform credentials with GitLab-specific ones:

• gitlab_root_password — only meaningful when GitLab is deployed
• git_token — GitLab PAT, used by Backstage and cicd-pipeline RGD

This blocks running the platform without GitLab (non-workshop use case): ESO ExternalSecrets on the hub that read gitlab_root_password or git_token from peeks-hub/secrets will fail with key does not exist when GitLab is not deployed.

Proposed fix

Split into two secrets:

Secret	Keys	Condition
peeks-hub/secrets	user_password, user_password_hash, user_password_key, backstage_postgres_password, grafana_mysql_password, devlake_mysql_password	Always seeded
peeks-hub/gitlab	gitlab_root_password, git_token	Only seeded when enable_gitlab: true

Impacted files

• cluster-providers/kind-kro-ack/Taskfile.yaml — secrets-manager:seed-secrets
• cluster-providers/kind-crossplane/Taskfile.yaml — secrets-manager:seed-secrets
• gitops/addons/charts/gitlab/templates/external-secret.yaml — read from peeks-hub/gitlab
• gitops/addons/charts/backstage/templates/install.yaml — git_token from peeks-hub/gitlab
• gitops/addons/charts/kro/resource-groups/manifests/cicd-pipeline/cicd-pipeline.yaml — GITLAB_TOKEN from peeks-hub/gitlab
• All charts reading these keys should gate on enable_gitlab

Notes

• Must be applied consistently to both kind-crossplane and kind-kro-ack providers
• user_password stays in peeks-hub/secrets — it is a Keycloak/IDC platform credential, not GitLab-specific
• git_token in CDK is seeded at stack creation time as root-<ide_password> — coordinate with CDK seeding logic