refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/argocd/apps/30-security.yaml

@@ -1,6 +1,6 @@
 # Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
 # runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
-# in k8s/security/iam) resolved by the ArgoCD SOPS plugin at sync time.
+# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -16,7 +16,7 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/k8s/security/iam/vault-values.yaml
+          - $values/k8s/infra/iam/vault-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -45,7 +45,7 @@ spec:
       targetRevision: "*"
       helm:
         valueFiles:
-          - $values/k8s/security/iam/authentik-values.yaml
+          - $values/k8s/infra/iam/authentik-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -70,7 +70,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/security/iam
+    path: k8s/infra/iam
   destination:
     server: https://kubernetes.default.svc
     namespace: iam
@@ -92,7 +92,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/security/ci-cd/charts/forgejo-runner
+    path: k8s/infra/forgejo-runner
   destination:
     server: https://kubernetes.default.svc
     namespace: cicd