refactor(freshrss): replace TrueCharts release with raw manifests

[luckycold]

Summary

• replace the FreshRSS TrueCharts HelmRelease with first-party repo manifests so the app keeps its current linuxserver runtime, PVC, ingress, and auth flow without chart coupling
• add an explicit VolSync ReplicationDestination so FreshRSS keeps the restore path that previously came from chart-managed persistence
• remove the unused code-server surface because the live Helm values already had addons.codeserver.enabled=false, and update the migration backup docs to reflect the new explicit restore manifest

Validation

• kubectl kustomize clusters/main/kubernetes
• flux diff ks freshrss --path clusters/main/kubernetes/apps/freshrss/app (expected non-zero because it reports the planned migration from HelmRelease to raw manifests)
• kubectl apply --dry-run=client -k clusters/main/kubernetes/apps/freshrss/app

Provider Notes

• I checked the actively updated christianhuth/freshrss chart and the already-available bjw-s/app-template chart as alternatives
• I chose raw manifests here because they remove the extra chart dependency entirely and preserve the current deployment shape with the least migration risk