ArgoCD couldn't decrypt secrets.yaml because it was listed as a plain kustomize resource. Move the 3 secrets (gotify-admin, gotify-tokens, gotify-smtp) to k8s/argocd/secrets/ as .enc.yaml files processed by the ksops generator, matching the repo convention. Fixes ComparisonError: 'Object Kind is missing' (SOPS ciphertext parsed as raw YAML).