feat(phase0): configure ArgoCD SOPS decryption + update encrypted secrets

Phase 0 continuation: enable ArgoCD to decrypt SOPS-encrypted secrets on sync.

1. Update ArgoCD Helm values (terraform/argocd-bootstrap.tf):
   - Add SOPS_AGE_KEY_FILE env var to repoServer
   - Mount sops-age K8s Secret at /home/argocd/.sops
   - Add ConfigManagementPlugin for SOPS (detects *.enc.yaml files)

2. Update encrypted secrets with real values:
   - k8s/base/secrets.enc.yaml: encrypted with actual service credentials
   - All secret values encrypted at rest in git
   - ArgoCD decrypts on sync using K8s Secret + AGE key

Prerequisites:
  - K8s Secret created: kubectl create secret generic sops-age -n argocd --from-file=keys.txt=/Users/rockliang/.sops/key.txt
  - SOPS_AGE_KEY_FILE env var set in ArgoCD repoServer (done above)

Next: Phase 1 — migrate 9 hookless releases to ArgoCD + create Applications that reference encrypted secrets.

terraform/argocd-bootstrap.tf

@@ -43,6 +43,22 @@ resource "helm_release" "argocd" {
         rbac = {
           "policy.default" = "role:readonly"
         }
+        cmp = {
+          create = true
+          plugins = {
+            sops = {
+              allowConcurrency = false
+              discover = {
+                fileName = "*.enc.yaml"
+              }
+              generate = {
+                command = ["sh", "-c"]
+                args = ["sops -d \"$ARGOCD_ENV_FILE_PATH\""]
+              }
+              lockRepo = false
+            }
+          }
+        }
       }
       server = {
         extraArgs = [
@@ -73,6 +89,10 @@ resource "helm_release" "argocd" {
             name  = "GIT_SSL_CAINFO"
             value = "/etc/ssl/certs/homelab-ca.crt"
           }
+          {
+            name  = "SOPS_AGE_KEY_FILE"
+            value = "/home/argocd/.sops/keys.txt"
+          }
         ]
         volumes = [
           {
@@ -81,6 +101,13 @@ resource "helm_release" "argocd" {
               secretName = "homelab-ca-secret"
             }
           }
+          {
+            name = "sops-age"
+            secret = {
+              secretName = "sops-age"
+              defaultMode = 384
+            }
+          }
         ]
         volumeMounts = [
           {
@@ -88,6 +115,11 @@ resource "helm_release" "argocd" {
             mountPath = "/etc/ssl/certs/homelab-ca.crt"
             subPath   = "tls.crt"
           }
+          {
+            name      = "sops-age"
+            mountPath = "/home/argocd/.sops"
+            readOnly  = true
+          }
         ]
       }
       controller = {