fix(bootstrap): complete Phase 4 ArgoCD bootstrap with all permanent fixes

- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml)
- Remove helm install --wait flag (talos-cp-2 slow node timeout issue)
- Add comprehensive progress logging with timestamps to bootstrap.sh
- Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key)
- Add local SOPS decryption for bootstrap secrets
- Add CNPG NetworkPolicy allowing app→database connectivity
- Disable Forgejo bundled dependencies (saves 66Gi storage)
- Inject database credentials via deployment.env (GITEA__DATABASE__*)
- Remove invalid ext4 mount options from StorageClass
- Add namespace manifests with PodSecurity labels
- Add encrypted forgejo-admin secret (SOPS)
- Reduce forgejo-db size 50Gi→25Gi per instance
- Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)

k8s/bootstrap/phase3-forgejo/cnpg-networkpolicy.yaml

@@ -0,0 +1,49 @@
+# NetworkPolicy for CNPG pods - allow pod-to-pod replication traffic
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: forgejo-db-allow-replication
+  namespace: cicd
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: forgejo-db
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow CNPG operator to reach instance status endpoints (port 8000)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+      ports:
+        - protocol: TCP
+          port: 8000
+    # Allow PostgreSQL connections from application pods (Forgejo)
+    - from:
+        - podSelector: {}
+          namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cicd
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow PostgreSQL replication from other CNPG pods
+    - from:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: forgejo-db
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Allow metrics scraping
+    - from:
+        - namespaceSelector: {}
+      ports:
+        - protocol: TCP
+          port: 9187
+  egress:
+    # Allow all egress (CNPG needs to reach services, API server, DNS, etc.)
+    # Restricting egress breaks replication through services
+    - {}