feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution

k8s/platform/logging/grafana-values.yaml

@@ -157,6 +157,18 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
+# Pin to az-a (talos-cp-1) — the only node running Longhorn. Without this the
+# scheduler may place grafana on cp-2/cp-3, where its Longhorn PVC cannot attach
+# ("CSINode does not contain driver driver.longhorn.io").
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: topology.kubernetes.io/zone
+              operator: In
+              values: [az-a]
+
 # ClusterIP only — access via ingress (grafana.riotpiao.com) or port-forward.
 service:
   type: ClusterIP