fix(bootstrap): complete Phase 4 ArgoCD bootstrap with all permanent fixes

- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml)
- Remove helm install --wait flag (talos-cp-2 slow node timeout issue)
- Add comprehensive progress logging with timestamps to bootstrap.sh
- Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key)
- Add local SOPS decryption for bootstrap secrets
- Add CNPG NetworkPolicy allowing app→database connectivity
- Disable Forgejo bundled dependencies (saves 66Gi storage)
- Inject database credentials via deployment.env (GITEA__DATABASE__*)
- Remove invalid ext4 mount options from StorageClass
- Add namespace manifests with PodSecurity labels
- Add encrypted forgejo-admin secret (SOPS)
- Reduce forgejo-db size 50Gi→25Gi per instance
- Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -1,11 +1,22 @@
 # Forgejo Helm Values — Single Source of Truth
 # Chart: https://codeberg.org/forgejo-contrib/forgejo-helm
 
+# Disable bundled dependencies (use external CNPG + Redis instead)
+postgresql-ha:
+  enabled: false
+
+valkey:
+  enabled: false
+
+valkey-cluster:
+  enabled: false
+
+redis:
+  enabled: false
+
 gitea:
   admin:
-    username: "admin"
-    email: "[email protected]"
-    # Password set via secret (not in values)
+    existingSecret: forgejo-admin
 
   config:
     server:
@@ -18,17 +29,7 @@ gitea:
       DB_TYPE: postgres
       HOST: forgejo-db-rw.cicd.svc.cluster.local:5432
       NAME: forgejo
-      # User/password from CNPG-generated secret
-      USER:
-        valueFrom:
-          secretKeyRef:
-            name: forgejo-db-app
-            key: username
-      PASSWD:
-        valueFrom:
-          secretKeyRef:
-            name: forgejo-db-app
-            key: password
+      # User/password injected via extraEnv (secretKeyRef doesn't work in config)
       
     cache:
       ADAPTER: redis
@@ -84,3 +85,17 @@ tolerations:
 # ArgoCD adoption labels
 labels:
   argocd.argoproj.io/instance: forgejo
+
+# Inject database credentials via environment variables (overrides app.ini)
+deployment:
+  env:
+    - name: GITEA__DATABASE__USER
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-db-app
+          key: username
+    - name: GITEA__DATABASE__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: forgejo-db-app
+          key: password