Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

project-usage/authentik-oidc.md

@@ -82,15 +82,15 @@ minio:
       - group: homelab-devops → readwrite
 ```
 
-**CLI device code flow (talos-cli):**
+**CLI device code flow (core CLI):**
 ```bash
 # Get JWT token (no kubeconfig needed)
-talos secrets login
+core secrets login
 # → Opens browser, approve device code
-# → Token cached in ~/.talos/token
+# → Token cached in ~/.core/token
 
 # Use token to access Vault
-talos get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
+core get cluster/ANTHROPIC_API_KEY --key ANTHROPIC_API_KEY
 # → Vault validates JWT from Authentik
 # → Returns secret
 ```
@@ -161,7 +161,7 @@ k get pods -n iam -l app=authentik
 ```bash
 # CLI tokens have 24h expiry
 # Re-authenticate
-talos secrets login
+core secrets login
 ```
 
 **Groups not syncing:**