fix(argocd): resolve 502 on argocd.riotpiao.com, dedupe Ingress and TLS mode mismatch

argocd-server ran --insecure (plain HTTP :8080) while its Helm-managed
Ingress set ssl-passthrough: true, which sends nginx's raw TLS handshake
straight to the pod - HTTP server can't complete a TLS handshake, nginx
logged 502 (peer closed connection in SSL handshake). Compounded by a
second, conflicting Ingress for the same host in
k8s/bootstrap/ingress/ingress.yaml - two Ingress objects on one host is
undefined nginx routing behavior. Disabled the Helm-managed Ingress
(enabled: false) so ingress.yaml's passthrough Ingress is the sole
source of truth, and set server.insecure: false so argocd-server
actually terminates TLS itself, matching passthrough's requirement.

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -6,23 +6,11 @@ global:
 
 # Server configuration
 server:
+  # Ingress is managed declaratively in k8s/bootstrap/ingress/ingress.yaml
+  # (ssl-passthrough) instead of here — two Ingress objects for the same
+  # host caused undefined nginx routing behavior (502s). Do not re-enable.
   ingress:
-    enabled: true
-    ingressClassName: nginx
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt-prod
-      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-    hosts:
-      - argocd.riotpiao.com
-    tls:
-      - secretName: argocd-server-tls
-        hosts:
-          - argocd.riotpiao.com
-
-  # Allow insecure mode (terminate TLS at ingress)
-  extraArgs:
-    - --insecure
+    enabled: false
 
   resources:
     requests:
@@ -152,7 +140,7 @@ configs:
     application.instanceLabelKey: argocd.argoproj.io/instance
     
   params:
-    server.insecure: true
+    server.insecure: false
 
   # RBAC (allow admin full access)
   rbac: