fix(argocd): repoURL http://forgejo.riotpiao.com:3000 -> https://forgejo.riotpiao.com

Root cause of widespread 'Unknown' sync status / Skipping auto-sync across
almost every Application: CoreDNS rewrites forgejo.riotpiao.com to the nginx
ingress controller service (rewrite name forgejo.riotpiao.com -> ingress-nginx-
controller...), which only listens on 80/443, not 3000. Every git fetch from
argocd-repo-server to the :3000 repoURL was timing out (context deadline
exceeded), so ArgoCD couldn't compare desired vs live state for any app.

Fix: use https://forgejo.riotpiao.com (no port, TLS via nginx + wildcard cert)
consistent with the 'all external endpoints HTTPS' requirement. Verified git
smart-http response 200 on the new URL before committing.

k8s/argocd/apps/60-applications.yaml

@@ -18,7 +18,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/applications/temporal/temporal-values.yaml
-    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -47,7 +47,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/applications/portainer/portainer-values.yaml
-    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -70,7 +70,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/applications/cloudflared
   destination:
@@ -93,7 +93,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/applications/duckdns
   destination: