feat: add prod workbench AppSets and charts (wave 13)

[acascais]

Summary

• Adds 4 ApplicationSets for prod workbench (guacamole, superset, jupyterhub, project-resources)
• Copies chart dirs from dev with domain changes (hdc.ebrains.eu, iam.hdc.ebrains.eu)
• Includes first prod project: indoctestproject
• Completes prod deployment -- all 13 waves now in place

What changed from dev

• AppSet git generator paths: clusters/dev/ -> clusters/prod/
• Domain parameter: dev.hdc.ebrains.eu -> hdc.ebrains.eu
• Keycloak domain: iam.dev.hdc.ebrains.eu -> iam.hdc.ebrains.eu (guacamole, jupyterhub, superset values)
• JupyterHub ingress hosts/TLS, OAuth URLs, spawner env vars -- all domain-swapped
• No workspacetest.yaml (dev test project excluded)

Prerequisites

Before indoctestproject apps will be healthy:

1. KC clients: guacamole-indoctestproject, jupyterhub + superset clients
2. Vault: secret/jupyterhub/indoctestproject, secret/superset/indoctestproject
3. DNS: indoctestproject-superset.hdc.ebrains.eu (wildcard or specific record)

Test plan

• make test ENV=prod -- all checks pass
• make test ENV=dev -- unchanged
• grep for dev.hdc or clusters/dev in prod workbench -- zero matches
• After merge: ArgoCD discovers AppSets, creates apps for indoctestproject in project-indoctestproject namespace
• ExternalSecrets sync once per-project Vault secrets are provisioned