feat(kopiur): replicate expanse repository to r2

[onedr0p]

Adds a RepositoryReplication that mirrors the expanse ClusterRepository to the kopiur bucket on Cloudflare R2 with kopia repository sync-to, plus an ExternalSecret carrying the R2 keys from the kopiur-r2 1Password item.

• Nightly at 05:00 (source timezone, America/New_York) with 30m jitter, after the hourly snapshots and the 03:00 full maintenance.
• sync.parallel: 8; the initial seed is ~27k blobs and kopia's default is a single sequential copier.
• Additive sync (deleteExtra left false), so blobs pruned by maintenance remain on R2 until that is enabled.
• The destination inherits the source repository's format and password; only R2 access keys are configured. The bucket already holds a partial byte-identical seed from the chorus attempt, which sync-to reconciles rather than duplicates.

Post-merge: trigger the first run rather than waiting for 05:00, e.g. kubectl kopiur replication run expanse-r2 -n kopiur-system, and watch kubectl get kopiarepl -n kopiur-system.

[bot-ross]

Note

2 resources added across 1 app

_{konflate 0.6.3 · rendered dbfbed5 · full diff →}