fix(bootstrap): complete Phase 4 ArgoCD bootstrap with all permanent fixes

- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml)
- Remove helm install --wait flag (talos-cp-2 slow node timeout issue)
- Add comprehensive progress logging with timestamps to bootstrap.sh
- Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key)
- Add local SOPS decryption for bootstrap secrets
- Add CNPG NetworkPolicy allowing app→database connectivity
- Disable Forgejo bundled dependencies (saves 66Gi storage)
- Inject database credentials via deployment.env (GITEA__DATABASE__*)
- Remove invalid ext4 mount options from StorageClass
- Add namespace manifests with PodSecurity labels
- Add encrypted forgejo-admin secret (SOPS)
- Reduce forgejo-db size 50Gi→25Gi per instance
- Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)

k8s/bootstrap/phase1-storage/storageclasses.yaml

@@ -2,8 +2,9 @@
 # The default 'longhorn' SC is created by Helm chart
 # These are additional specialized classes
 ---
-# CNPG-specific StorageClass with postgres UID/GID mount options
-# Fixes "read-only filesystem" error when PostgreSQL (UID 26) tries to write
+# CNPG-specific StorageClass for PostgreSQL volumes
+# CNPG handles filesystem ownership via securityContext.fsGroup (UID/GID 26)
+# Separate from default 'longhorn' to allow CNPG-specific tuning
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -19,9 +20,7 @@ parameters:
   fromBackup: ""
   dataLocality: "best-effort"
   fsType: "ext4"
-mountOptions:
-  - "noatime"
-  - "uid=26"   # postgres user
-  - "gid=26"   # postgres group
+# mountOptions removed - uid/gid are NOT valid for ext4 (only for FAT/VFAT)
+# CNPG handles ownership via securityContext.fsGroup automatically
 reclaimPolicy: Delete
 volumeBindingMode: Immediate