fix(bootstrap): complete Phase 4 ArgoCD bootstrap with all permanent fixes

- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml)
- Remove helm install --wait flag (talos-cp-2 slow node timeout issue)
- Add comprehensive progress logging with timestamps to bootstrap.sh
- Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key)
- Add local SOPS decryption for bootstrap secrets
- Add CNPG NetworkPolicy allowing app→database connectivity
- Disable Forgejo bundled dependencies (saves 66Gi storage)
- Inject database credentials via deployment.env (GITEA__DATABASE__*)
- Remove invalid ext4 mount options from StorageClass
- Add namespace manifests with PodSecurity labels
- Add encrypted forgejo-admin secret (SOPS)
- Reduce forgejo-db size 50Gi→25Gi per instance
- Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)

k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml

@@ -0,0 +1,34 @@
+# ArgoCD CMP plugin for SOPS secret decryption
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmp-cm
+  namespace: argocd
+data:
+  sops-secrets-v1.0.yaml: |
+    apiVersion: argoproj.io/v1alpha1
+    kind: ConfigManagementPlugin
+    metadata:
+      name: sops-secrets-v1.0
+    spec:
+      version: v1.0
+      init:
+        command: [sh, -c]
+        args:
+          - |
+            # Install sops if not present
+            if ! command -v sops &> /dev/null; then
+              wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops
+              chmod +x /usr/local/bin/sops
+            fi
+      generate:
+        command: [sh, -c]
+        args:
+          - |
+            # Find all .enc.yaml files and decrypt them
+            find . -name '*.enc.yaml' -type f | while read -r file; do
+              sops -d "$file"
+            done
+      discover:
+        find:
+          glob: "**/*.enc.yaml"