Automate spoke cluster Secrets Manager seeding via Crossplane composition

[punkwalker]

Parent: #584
Priority: High

The PlatformCluster composition should create the Secrets Manager entry as part of cluster provisioning. Currently this is a manual step after the EKS cluster is ready.

The composition already has the ARN, VPC ID, and region. Add a Secrets Manager Secret resource to the composition that creates {clusterName}/config with:

• server: cluster ARN
• config: {"tlsClientConfig":{"insecure":false}}
• metadata: JSON with aws_region, aws_cluster_name, aws_vpc_id, repo URLs, and other annotations

This eliminates the manual seeding step and makes spoke provisioning fully GitOps-driven:

1. Add cluster to fleet/kro-values/tenants/{tenant}/kro-clusters/values.yaml
2. Add fleet member to fleet/members/{name}/values.yaml
3. Add environment overlays/environments/{env}/enabled-addons.yaml
4. Commit and push — Crossplane provisions cluster, seeds secret, ExternalSecret creates ArgoCD cluster secret, addons deploy

Challenges:

• Secrets Manager secret value is a JSON string containing nested JSON — composition patching may be complex
• The metadata JSON includes repo URLs and basepath which come from the hub cluster secret, not the composition
• Need to handle the hub cluster differently (seed secret created by Taskfile, not composition)