fix(bootstrap): complete Phase 4 ArgoCD bootstrap with all permanent fixes

- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml)
- Remove helm install --wait flag (talos-cp-2 slow node timeout issue)
- Add comprehensive progress logging with timestamps to bootstrap.sh
- Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key)
- Add local SOPS decryption for bootstrap secrets
- Add CNPG NetworkPolicy allowing app→database connectivity
- Disable Forgejo bundled dependencies (saves 66Gi storage)
- Inject database credentials via deployment.env (GITEA__DATABASE__*)
- Remove invalid ext4 mount options from StorageClass
- Add namespace manifests with PodSecurity labels
- Add encrypted forgejo-admin secret (SOPS)
- Reduce forgejo-db size 50Gi→25Gi per instance
- Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -1,4 +1,4 @@
-# ArgoCD Helm Values — Single Source of Truth
+# ArgoCD Helm Values — Bootstrap Mode (SOPS plugin added post-bootstrap)
 # Chart: https://github.com/argoproj/argo-helm
 
 global:
@@ -32,6 +32,12 @@ server:
       cpu: 500m
       memory: 1Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Repo server configuration
 repoServer:
   resources:
@@ -42,21 +48,11 @@ repoServer:
       cpu: 500m
       memory: 1Gi
 
-  # SOPS plugin for encrypted secrets
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
-        optional: true
-  volumeMounts:
-    - name: sops-age
-      mountPath: /home/argocd/.config/sops/age
-      readOnly: true
-
-  # Environment for SOPS
-  env:
-    - name: SOPS_AGE_KEY_FILE
-      value: /home/argocd/.config/sops/age/keys.txt
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
 
 # Controller configuration
 controller:
@@ -68,6 +64,12 @@ controller:
       cpu: 1000m
       memory: 2Gi
 
+  # Tolerations for control-plane
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 # Application controller configuration
 applicationSet:
   enabled: true
@@ -87,26 +89,7 @@ redis:
       cpu: 200m
       memory: 256Mi
 
-# Tolerations for control-plane
-server:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-repoServer:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-controller:
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-
-# ArgoCD projects
+# ArgoCD configuration
 configs:
   # Default project allows all repos
   cm:
@@ -116,8 +99,7 @@ configs:
   params:
     server.insecure: true
 
-# RBAC (allow admin full access)
-configs:
+  # RBAC (allow admin full access)
   rbac:
     policy.default: role:readonly
     policy.csv: |