feat: improve security and stability for Vaultwarden and CodiMD

Security:
- Move Vaultwarden ADMIN_TOKEN to Secret (was plaintext)
- Remove root user execution from CodiMD (runAsUser: 0)
- Use fixed image versions instead of latest tag

Stability:
- Add liveness/readiness probes to Vaultwarden, CodiMD, CodiMD DB
- Add resource requests/limits to all services
- Set appropriate memory/CPU constraints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/vaultwarden/manifests/vaultwarden-deployment.yaml

@@ -16,8 +16,11 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.32.7-alpine
           resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
             limits:
               memory: "512Mi"
               cpu: "500m"
@@ -29,7 +32,27 @@ spec:
             - name: DOMAIN
               value: "https://vaultwarden.lotimmy.com"
             - name: ADMIN_TOKEN
-              value: "$$argon2id$$v=19$$m=65540,t=3,p=4$$EVIbGzNlkQUK5b0r7aMgKoUWV98aqrpPevU+8Bbv0EE$$JB51q0ih0LGmw6rp7ZVBgT+PNnCepy+bNYyaChD+VMc"
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-secret
+                  key: ADMIN_TOKEN
+          # Health check
+          livenessProbe:
+            httpGet:
+              path: /alive
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /alive
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           volumeMounts:
             - mountPath: "/data"
               name: data-vol