Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

project-usage/sqs-messaging.md

@@ -144,10 +144,10 @@ KEYS "kmsvc:inflight:*" | wc -l
 **Requires JWT from Authentik:**
 ```bash
 # Get token (device code flow)
-talos secrets login
+core secrets login
 
 # Use token
-export JWT_TOKEN=$(talos get cluster/kmsvc/jwt-token --key jwt-token)
+export JWT_TOKEN=$(core get cluster/kmsvc/jwt-token --key jwt-token)
 curl -H "Authorization: Bearer $JWT_TOKEN" https://kmsvc.riotpiao.homelab.com/v1/queues
 ```