Migrate Joplin to K3s and add existing k8s manifests

- New k8s/joplin/ deployment for note.expertfab.de (Postgres + Server +
  Traefik ingress with cert-manager), replicas=2 to match cluster size
- coredns-custom.yaml: route note.expertfab.de internally to Traefik LB
- Commit previously-built k8s manifests (documenso, erpnext oauth2-proxy,
  paperless oauth2-proxy) that were running but not in git
- docs/access.md: add Joplin section and Documenso/Cloudflare entries

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

k8s/coredns-custom.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns-custom
+  namespace: kube-system
+data:
+  expertfab.server: |
+    expertfab.de:53 {
+      hosts {
+        10.42.71.60 auth.expertfab.de
+        10.42.71.60 docs.expertfab.de
+        10.42.71.60 www.expertfab.de
+        10.42.71.60 expertfab.de
+        10.42.71.60 api.expertfab.de
+        10.42.71.60 signing.expertfab.de
+        10.42.71.60 note.expertfab.de
+        fallthrough
+      }
+      forward . 10.42.71.1
+    }
+    coworkbase.de:53 {
+      hosts {
+        10.42.71.60 coworkbase.de
+        10.42.71.60 www.coworkbase.de
+        fallthrough
+      }
+      forward . 10.42.71.1
+    }