fix(kyverno): use static RESTIC_REPOSITORY from 1Password instead of template

Problem: Kyverno cannot generate ExternalSecrets with Go templates because it tries
to parse {{ }} as Kyverno variables, regardless of escaping method.

Solution: Store RESTIC_REPOSITORY base URL in 1Password rustfs item:
  restic_repository: s3:http://192.168.10.133:30292/volsync/

Note: This is the base URL - per-PVC paths will be handled by VolSync itself
using the repository secret name pattern.

Author: mitchross

docs/secrets/volsync-secrets.md

@@ -16,9 +16,12 @@ Create a **Password** item in your 1Password vault:
 | **access_key** | RustFS access key |
 | **secret_key** | RustFS secret key |
 | **restic_password** | A strong random password (32+ characters) |
+| **restic_repository** | `s3:http://192.168.10.133:30292/volsync/` |
 
 The `restic_password` encrypts all backup repositories stored in S3.
 
+The `restic_repository` is the S3 endpoint - each PVC will have its namespace and name appended automatically.
+
 **Generate a secure password:**
 ```bash
 openssl rand -base64 32