feat(xui): add 3x-ui VPN panel behind cloudflared tunnel

VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.

vpn/xui/k8s/xui.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: xui-service
+  namespace: xui
+spec:
+  selector:
+    app: xui
+  ports:
+    - port: 30379
+      name: panel
+      targetPort: 30379
+    - port: 10000
+      name: xray
+      targetPort: 10000
+    - port: 2096
+      name: sub
+      targetPort: 2096
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: xui-deployment
+  namespace: xui
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: xui
+  template:
+    metadata:
+      labels:
+        app: xui
+    spec:
+      containers:
+        - name: xui
+          image: ghcr.io/mhsanaei/3x-ui:v3.8.5
+          envFrom:
+            - configMapRef:
+                name: xui-config
+          tty: true
+          ports:
+            - containerPort: 30379
+              name: panel
+            - containerPort: 10000
+              name: xray
+            - containerPort: 2096
+              name: sub
+          volumeMounts:
+            - name: x-ui-db
+              mountPath: /etc/x-ui
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+      volumes:
+        - name: x-ui-db
+          persistentVolumeClaim:
+            claimName: xui-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: xui-pvc
+  namespace: xui
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi