fix(argocd): CPU limit throttling repo-server, skip non-manifest .enc.yaml docs, add grafana-admin admin-user key

repoServer CPU limit (500m) was too tight once the SOPS sidecar added real
decrypt work under the liveness probe's 1s timeout — repo-server kept
getting killed mid-sync. Raised to 1000m (node has 23+ idle cores, no
scarcity). Separately, the generate script's doc-separator fix exposed
that several .enc.yaml files (cloudflared, temporal, authentik, loki) are
raw Helm-values snippets, not K8s manifests — ArgoCD hard-failed the whole
batch on the first one missing 'kind:'. Script now skips those, so
correctly-shaped Secrets (grafana-admin included) sync independently.
grafana-admin also needed an admin-user key alongside admin-password —
the chart looks up both from the same existingSecret.

k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml

@@ -15,9 +15,15 @@ data:
         command: [sh, -c]
         args:
           - |
-            # Find all .enc.yaml files and decrypt them
+            # Find all .enc.yaml files and decrypt them, separating multi-doc output.
+            # Skip files that aren't full K8s manifests (no top-level "kind:") — some
+            # .enc.yaml files hold raw Helm values, not standalone Secret objects.
             find . -name '*.enc.yaml' -type f | while read -r file; do
-              sops -d "$file"
+              decrypted=$(sops -d "$file")
+              if echo "$decrypted" | grep -q '^kind:'; then
+                echo "---"
+                echo "$decrypted"
+              fi
             done
       discover:
         find:

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -45,7 +45,7 @@ repoServer:
       cpu: 100m
       memory: 256Mi
     limits:
-      cpu: 500m
+      cpu: 1000m
       memory: 1Gi
 
   # Tolerations for control-plane