harbor: jobservice PVC (resourcePolicy: keep) and ACME solver resources orphaned after deletion #3061

Describe the bug

After deleting a Harbor app CR, the jobservice PVC and cert-manager ACME http-solver resources remain in the namespace.

Environment

• Cozystack version: v1.4.0-rc.2
• Provider: on-prem (bare-metal)

To Reproduce

1. Create a tenant with seaweedfs: true, deploy Harbor/test.
2. Wait until Ready.
3. Delete the Harbor CR; wait ~120s.
4. kubectl -n <ns> get pvc,ingress | grep -E 'jobservice|cm-acme' — both remain.

Expected behaviour
No orphaned PVC / ACME solver resources remain after the app CR is deleted.

Actual behaviour

pvc/harbor-test-jobservice                Bound
ingress/cm-acme-http-solver-xxxxx
pod/cm-acme-http-solver-xxxxx
service/cm-acme-http-solver-xxxxx

Additional context

• Root cause (PVC): packages/apps/harbor/templates/harbor.yaml:102 sets persistence.resourcePolicy: "keep", which annotates Harbor PVCs with helm.sh/resource-policy: keep — so Helm/Flux deliberately never deletes them on uninstall. No cleanup hook overrides this.
• Root cause (ACME): Harbor renders its own Ingress (templates/ingress.yaml:21-26). It has a $wildcardSecret guard (skips ACME in wildcard mode), but in non-wildcard (http01) mode it sets cluster-issuer → same orphaned-stuck-challenge mechanism as the Bucket issue.
• Proposed fix (two parts):
  • PVC: add a post-delete PVC cleanup hook (packages/apps/harbor/templates/hooks/cleanup-pvc.yaml, modeled on MariaDB), selecting app.kubernetes.io/instance={{ .Release.Name }}. A hook is required precisely because resourcePolicy: keep blocks normal reclaim. (If retaining data on delete is intentional, that is a product decision — otherwise the hook closes the leak.)
  • ACME: same as the Bucket issue.

Found during a create→delete leak sweep of all 22 apps on Cozystack v1.4.0-rc.2.