Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

.env.terraform.sh.example

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Terraform environment setup example
+# Copy to .env.terraform.sh and fill in real values from .env
+# Then: source .env.terraform.sh && cd terraform && terraform plan
+
+# MinIO S3 backend credentials (from .env MINIO_ROOT_USER / MINIO_ROOT_PASSWORD)
+export AWS_ACCESS_KEY_ID="minioadmin"
+export AWS_SECRET_ACCESS_KEY="<MINIO_ROOT_PASSWORD from .env>"
+
+# Kubernetes config (points to cluster-config/kubeconfig)
+export KUBECONFIG="${PWD}/cluster-config/kubeconfig"