feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

USAGE.md

@@ -209,7 +209,7 @@ core iam list-apps
 #### Create New Application
 
 ```bash
-core iam create-app "my-service" --slug my-service --redirect-uri "https://my-service.riotpiao.homelab.com/callback"
+core iam create-app "my-service" --slug my-service --redirect-uri "https://my-service.riotpiao.com/callback"
 ```
 
 Returns client ID and secret (save immediately).
@@ -331,13 +331,13 @@ core get cluster/iam/roles/admin --key roles
 export REGISTRY_TOKEN=$(core get cluster/iam/agents/ci-bot --key token)
 
 # 2. Authenticate docker/podman to Forgejo registry
-docker login forgejo.riotpiao.homelab.com \
+docker login forgejo.riotpiao.com \
   --username ci-bot \
   --password "$REGISTRY_TOKEN"
 
 # 3. Tag and push image
-docker tag myapp:latest forgejo.riotpiao.homelab.com/rock/myapp:latest
-docker push forgejo.riotpiao.homelab.com/rock/myapp:latest
+docker tag myapp:latest forgejo.riotpiao.com/rock/myapp:latest
+docker push forgejo.riotpiao.com/rock/myapp:latest
 ```
 
 **Pull images in runner (automatic):**
@@ -345,7 +345,7 @@ docker push forgejo.riotpiao.homelab.com/rock/myapp:latest
 ```bash
 # Inside .forgejo/workflows/*.yml, runner pulls via K8s ServiceAccount
 # No explicit login needed — imagePullSecrets injected by runner pod
-image: forgejo.riotpiao.homelab.com/rock/myapp:latest
+image: forgejo.riotpiao.com/rock/myapp:latest
 ```
 
 **Runner pod setup:**