Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/terraform.tfvars.example

@@ -1,7 +1,20 @@
 kubeconfig_path = "cluster-config/kubeconfig"
 cluster_domain  = "riotpiao.homelab.com"
 
-# Load these from .env or Vault in production
+# Backend S3 credentials (MinIO)
+# Set via environment variables instead:
+#   export AWS_ACCESS_KEY_ID=$(grep MINIO_ROOT_USER .env | cut -d= -f2)
+#   export AWS_SECRET_ACCESS_KEY=$(grep MINIO_ROOT_PASSWORD .env | cut -d= -f2)
+s3_access_key = ""
+s3_secret_key = ""
+
+# Vault token for terraform vault provider
+# Set via environment variable:
+#   export VAULT_TOKEN=$(vault login -method=oidc ...)
+vault_token = ""
+
+# Cluster secrets loaded from .env (extract via 'vsource' alias)
+# Or populate these manually from Vault/secrets manager
 authentik_secret_key              = "changeme-min-32-characters-long-value"
 authentik_bootstrap_password      = "changeme"
 authentik_bootstrap_token         = "changeme"