fix(vms): deliver UniFi cloud-init via Secret (userDataSecretRef) — 2048B limit

Adding the SSH key pushed the inline cloudInitNoCloud.userData over KubeVirt's
2048-byte limit ("userdata exceeds 2048 byte limit. Should use UserDataSecretRef").
Move the cloud-init into apps/vms/unifi/unifi-cloudinit.yaml and wrap it as the
`unifi-cloudinit` Secret via a Kustomize secretGenerator (disableNameSuffixHash
so the VM can reference it by fixed name); VM now uses userDataSecretRef. Content
is non-sensitive (public key + public installer script), so not SOPS-encrypted.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/vms/unifi/kustomization.yaml

@@ -11,3 +11,15 @@ resources:
   - 30-virtualmachine.yaml
   - 40-networkpolicy.yaml
   - 50-service-l4.yaml
+# The VM's cloud-init (SSH key + UOS install script) exceeds KubeVirt's 2048-byte inline userData
+# limit, so it is delivered via a Secret (30-virtualmachine.yaml userDataSecretRef: unifi-cloudinit).
+# secretGenerator wraps the readable unifi-cloudinit.yaml file as key `userdata`. disableNameSuffixHash
+# keeps the name stable (the VM references it by fixed name — Kustomize can't rewrite a KubeVirt
+# userDataSecretRef). Content is non-sensitive (public key + public installer), so NOT SOPS-encrypted.
+secretGenerator:
+  - name: unifi-cloudinit
+    namespace: unifi
+    files:
+      - userdata=unifi-cloudinit.yaml
+generatorOptions:
+  disableNameSuffixHash: true