feat(vms): onboard UniFi OS Server as a KubeVirt VM on a non-gating track

First KubeVirt VM app + first real CDI http import. UniFi OS Server (UOS) is
Ubiquiti's current self-host product (the .deb is deprecated); it bundles UniFi
OS + Network app + its own datastore, so no MongoDB companion.

- apps/vms/unifi: CDI DataVolume (Ubuntu 24.04 cloud image -> longhorn-vm
  RWX/Block, live-migratable) + VirtualMachine (evictionStrategy: LiveMigrate)
  with cloud-init that installs podman/slirp4netns/jq and runs the UOS installer
  NON-INTERACTIVELY. The installer URL is resolved at boot from Ubiquiti's public
  firmware API (fw-update.ui.com/api/firmware-latest) — always-latest, no pinned
  URL to maintain (currently UOS v5.1.37).
- L4 exposure: two LoadBalancer Services (TCP+UDP) sharing a pinned, L2-announced
  Cilium VIP 192.168.1.54 (device inform/adoption + STUN can't ride the L7
  Gateway); external-dns publishes unifi.home.keithjackson.dev. UI on :11443.
- default-deny + additive CNPs (controller ingress, egress, and CDI-importer
  egress for the image pull).
- clusters/base/apps-vms.yaml: NON-GATING Flux Kustomization (wait:false,
  dependsOn platform-config) — VMs are a separate lifecycle from the app waves,
  so a slow VM import/install can't stall the app tier.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/apps-vms.yaml

@@ -0,0 +1,29 @@
+---
+# Flux Kustomization: VM tier (KubeVirt VirtualMachines). Reconciles ./apps/vms.
+#
+# NON-GATING (wait:false): unlike the app waves, this does NOT health-wait. A VM's first-boot image
+# import (CDI, minutes) + in-guest software install mean a VM can be intentionally long-not-Ready, so
+# health-gating it would wedge reconciliation for no benefit. VMs have no in-cluster dependents.
+# dependsOn platform-config so KubeVirt/CDI + the longhorn-vm StorageClass + CDI StorageProfiles
+# exist first. prune:true — this Kustomization solely owns the VM manifests (no adoption concern).
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: apps-vms
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 2m
+  timeout: 5m
+  prune: true
+  wait: false
+  dependsOn:
+    - name: platform-config
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./apps/vms
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars

clusters/base/kustomization.yaml

@@ -15,4 +15,6 @@ resources:
   - apps-wave-0.yaml     # Flux Kustomization -> ./apps/wave-0 (dependsOn platform-config)
   - apps-wave-1.yaml     # Flux Kustomization -> ./apps/wave-1 (dependsOn apps-wave-0)
   - apps-wave-2.yaml     # Flux Kustomization -> ./apps/wave-2 (dependsOn apps-wave-1)
+  # VM tier (KubeVirt) — non-gating (wait:false), separate lifecycle from the app waves.
+  - apps-vms.yaml        # Flux Kustomization -> ./apps/vms (dependsOn platform-config)
   - cluster-vars.yaml    # overlay knob surface (base defaults)