Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/variables.tf

@@ -10,6 +10,27 @@ variable "cluster_domain" {
   default     = "riotpiao.homelab.com"
 }
 
+variable "vault_token" {
+  description = "Vault token (set via VAULT_TOKEN env var or tfvars)"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "s3_access_key" {
+  description = "MinIO S3 access key for terraform state backend"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "s3_secret_key" {
+  description = "MinIO S3 secret key for terraform state backend"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
 # Cluster secrets (load from .env.tfvars or vault)
 variable "authentik_secret_key" {
   description = "Authentik secret key"