feat(vms): onboard UniFi OS Server as a KubeVirt VM on a non-gating track

First KubeVirt VM app + first real CDI http import. UniFi OS Server (UOS) is
Ubiquiti's current self-host product (the .deb is deprecated); it bundles UniFi
OS + Network app + its own datastore, so no MongoDB companion.

- apps/vms/unifi: CDI DataVolume (Ubuntu 24.04 cloud image -> longhorn-vm
  RWX/Block, live-migratable) + VirtualMachine (evictionStrategy: LiveMigrate)
  with cloud-init that installs podman/slirp4netns/jq and runs the UOS installer
  NON-INTERACTIVELY. The installer URL is resolved at boot from Ubiquiti's public
  firmware API (fw-update.ui.com/api/firmware-latest) — always-latest, no pinned
  URL to maintain (currently UOS v5.1.37).
- L4 exposure: two LoadBalancer Services (TCP+UDP) sharing a pinned, L2-announced
  Cilium VIP 192.168.1.54 (device inform/adoption + STUN can't ride the L7
  Gateway); external-dns publishes unifi.home.keithjackson.dev. UI on :11443.
- default-deny + additive CNPs (controller ingress, egress, and CDI-importer
  egress for the image pull).
- clusters/base/apps-vms.yaml: NON-GATING Flux Kustomization (wait:false,
  dependsOn platform-config) — VMs are a separate lifecycle from the app waves,
  so a slow VM import/install can't stall the app tier.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/vms/unifi/namespace.yaml

@@ -0,0 +1,19 @@
+---
+# UniFi (KubeVirt VM) namespace. Reconciled by the NON-GATING `apps-vms` Flux Kustomization
+# (clusters/base/apps-vms.yaml, wait:false) — VMs are a separate lifecycle from the rendered
+# container-app waves, and UniFi has no in-cluster dependents, so a slow VM import/install can't
+# stall the app tier.
+#
+# Namespace (trust zone). Carries the app-namespace label (Kyverno require-auth-mode-label
+# + default-deny apply here) and gateway-access=shared so an OPTIONAL HTTPRoute could
+# attach to the shared Gateway (see 90-httproute-optional.yaml). backup-policy matches the
+# vm-demo/pihole convention so the VM's Longhorn disk is captured off-cluster.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: unifi
+  labels:
+    homelab.keithjackson.dev/app-namespace: 'true'
+    gateway-access: shared
+  annotations:
+    homelab.keithjackson.dev/backup-policy: daily-offcluster