fix(minio): migrate to official chart, TF-owned

Bitnami wiped Docker Hub catalog (bitnami/minio: 0 tags), chart 14.1.0
dead on ImagePullBackOff. Move to minio/minio 5.4.0 (quay.io) as one TF
helm_release. Add longhorn-xfs SC: default SC ext4 mkfs on 100Gi exceeds
kubelet mount timeout, xfs near-instant. Drop minio ArgoCD Apps (TF owns
now, kills dual-controller conflict). Fix double base64 on OIDC secret.

terraform/argocd-bootstrap.tf

@@ -8,6 +8,22 @@ resource "kubernetes_namespace" "argocd" {
   }
 }
 
+# Copy homelab-ca-secret from cert-manager to argocd namespace
+# (Required for repo-server pod to verify self-signed forgejo TLS)
+resource "null_resource" "copy_ca_secret_to_argocd" {
+  provisioner "local-exec" {
+    command = <<-EOT
+      kubectl get secret homelab-ca-secret -n cert-manager -o yaml | \
+        sed 's/namespace: cert-manager/namespace: argocd/' | \
+        kubectl apply -f -
+    EOT
+  }
+
+  depends_on = [
+    kubernetes_namespace.argocd
+  ]
+}
+
 resource "helm_release" "argocd" {
   name       = "argocd"
   repository = local.helm_repos["argo"]
@@ -27,13 +43,6 @@ resource "helm_release" "argocd" {
         rbac = {
           "policy.default" = "role:readonly"
         }
-        repositories = {
-          "minio-operator" = {
-            url      = "https://operator.min.io"
-            name     = "minio-operator"
-            type     = "helm"
-          }
-        }
       }
       server = {
         extraArgs = [
@@ -44,6 +53,14 @@ resource "helm_release" "argocd" {
           hosts = [
             "argocd.${var.cluster_domain}"
           ]
+          annotations = {
+            "nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
+          }
+          ingressClassName = "nginx"
+        }
+        service = {
+          type = "ClusterIP"
+          port = 80
         }
       }
       repoServer = {
@@ -80,7 +97,8 @@ resource "helm_release" "argocd" {
   ]
 
   depends_on = [
-    kubernetes_namespace.argocd
+    kubernetes_namespace.argocd,
+    null_resource.copy_ca_secret_to_argocd
   ]
 
   # Note: lifecycle.ignore_changes removed to allow CA cert update
@@ -97,8 +115,7 @@ resource "kubernetes_manifest" "argocd_project" {
     }
     spec = {
       sourceRepos = [
-        "https://forgejo.riotpiao.homelab.com/riotpiao.com/*",
-        "https://operator.min.io"
+        "https://forgejo.riotpiao.homelab.com/riotpiao.com/*"
       ]
       destinations = [
         {