revert(phase4): Remove Pod Job approach for Terraform apply

Reverting Phase 4 Pod Job implementation in favor of CI runner (Forgejo Actions).

Deleted:
- k8s/argocd/apps/phase4-terraform-0.yaml
- k8s/hooks/phase4/ (terraform-apply-hook.yaml, terraform-rbac.yaml, terraform-s3-secrets.enc.yaml)

Reason: Pod Job approach had limitations (eviction, timeouts, pod security policies).
Next: Implement Forgejo Actions CI workflow for terraform apply.

k8s/argocd/apps/phase4-terraform-0.yaml

@@ -1,26 +0,0 @@
-# Phase 4 — IaC (Terraform) — infrastructure-as-code via Hook Job
-# ArgoCD-driven terraform apply. All changes via git push.
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: terraform-apply
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/hooks/phase4
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

k8s/hooks/phase4/terraform-apply-hook.yaml

@@ -1,118 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: terraform-apply
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 3
-  template:
-    spec:
-      serviceAccountName: terraform-apply
-      containers:
-      - name: terraform
-        image: hashicorp/terraform:latest
-        command: ["/bin/sh", "-c"]
-        args:
-        - |
-          set -e
-
-          echo "=== Terraform Apply Hook (ArgoCD PostSync) ==="
-
-          # Trust homelab CA for self-signed Forgejo certificate
-          cp /etc/ssl/certs/homelab-ca.crt /usr/local/share/ca-certificates/homelab-ca.crt
-          update-ca-certificates
-
-          # Clone repo
-          git clone --depth 1 https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git /repo
-          cd /repo/terraform
-
-          # Load S3 credentials from mounted secrets
-          export AWS_ACCESS_KEY_ID=$(cat /run/secrets/s3/AWS_ACCESS_KEY_ID)
-          export AWS_SECRET_ACCESS_KEY=$(cat /run/secrets/s3/AWS_SECRET_ACCESS_KEY)
-          export AWS_ENDPOINT_URL=$(cat /run/secrets/s3/AWS_ENDPOINT_URL)
-
-          # Create AWS credentials file with minio profile
-          mkdir -p ~/.aws
-          cat > ~/.aws/credentials << EOF
-          [minio]
-          aws_access_key_id = $(cat /run/secrets/s3/AWS_ACCESS_KEY_ID)
-          aws_secret_access_key = $(cat /run/secrets/s3/AWS_SECRET_ACCESS_KEY)
-          EOF
-
-          cat > ~/.aws/config << EOF
-          [default]
-          region = us-east-1
-          EOF
-
-          # Generate in-cluster kubeconfig for Terraform provider
-          mkdir -p /root/.kube
-          cat > /root/.kube/config << KUBEEOF
-          apiVersion: v1
-          kind: Config
-          clusters:
-          - cluster:
-              certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-              server: https://kubernetes.default:443
-            name: in-cluster
-          contexts:
-          - context:
-              cluster: in-cluster
-              user: terraform
-            name: in-cluster
-          current-context: in-cluster
-          users:
-          - name: terraform
-            user:
-              tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
-          KUBEEOF
-
-          export KUBECONFIG=/root/.kube/config
-
-          # Initialize and apply
-          echo "Initializing Terraform..."
-          terraform init
-
-          echo "Planning Terraform changes..."
-          terraform plan \
-            -var "kubeconfig_path=/root/.kube/config" \
-            -out=tfplan
-
-          echo "Applying Terraform..."
-          terraform apply -auto-approve tfplan
-
-          echo "✓ Terraform apply complete"
-        volumeMounts:
-        - name: s3-creds
-          mountPath: /run/secrets/s3
-          readOnly: true
-        - name: homelab-ca
-          mountPath: /etc/ssl/certs/homelab-ca.crt
-          subPath: tls.crt
-          readOnly: true
-        resources:
-          requests:
-            memory: "256Mi"
-            cpu: "250m"
-          limits:
-            memory: "1Gi"
-            cpu: "1"
-      volumes:
-      - name: s3-creds
-        projected:
-          sources:
-          - secret:
-              name: terraform-s3-creds
-              items:
-              - key: AWS_ACCESS_KEY_ID
-                path: AWS_ACCESS_KEY_ID
-              - key: AWS_SECRET_ACCESS_KEY
-                path: AWS_SECRET_ACCESS_KEY
-              - key: AWS_ENDPOINT_URL
-                path: AWS_ENDPOINT_URL
-      - name: homelab-ca
-        secret:
-          secretName: homelab-ca-secret
-      restartPolicy: Never

k8s/hooks/phase4/terraform-rbac.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-apply
-  namespace: argocd
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: terraform-apply
-rules:
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["*"]
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: terraform-apply
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: terraform-apply
-subjects:
-- kind: ServiceAccount
-  name: terraform-apply
-  namespace: argocd

k8s/hooks/phase4/terraform-s3-secrets.enc.yaml

@@ -1,25 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:kiY=,iv:wvX0y4RDJQbk7fGdXWbSQr60WfM3M5rvc7SCPb1q25g=,tag:C71TErBwHF5FKHzeLXaMzA==,type:str]
-kind: ENC[AES256_GCM,data:WILs0jRC,iv:vkkqDYv45946c21yEWBZf0USa0b3IZuhQAXhdSjDKvU=,tag:Sn6ViACi321IUkd8YHfpsQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:WQw0C3Y0MhkHyhJyY7oD9Ib9,iv:+OaUam5cBOwL8eXuxi5clYvV8HvjQgJ7N7mcjmIcpOg=,tag:II2lOgY0edI+bvd3fSreiQ==,type:str]
-    namespace: ENC[AES256_GCM,data:hSaYZZ+E,iv:BpL3rZSdoM1zvsXNZWISUQBEm6Blv7REGeeVQnHBDP4=,tag:tlmhyRvE3coSFehyKFTsGw==,type:str]
-type: ENC[AES256_GCM,data:FQ2B9iNr,iv:aZ4Ah0TzsMciw0NiMBc3vPsMHAczwzeTuhTos+GjuCg=,tag:7V3t9VkcHlhHK9+4Oo6i2A==,type:str]
-stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:i4b932+5rglSbg==,iv:6z2HLtTYXUfwkuPzzNZakJ+8UYkpHNs1otrz/lScuLM=,tag:4FxelmrF5p+EF79hGB+ejQ==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:ATzJ0GwtWVgMc+pnLxoW0zLB37h94HxSoUTsad9Efpe9z0zh3HBdquCr4ek=,iv:dPxiRhnxqEEbtZZW4aSRnByv1rQCcbc0R/ot9bCBiHg=,tag:IpXFDVjc6kJKP7NqDXpAAQ==,type:str]
-    AWS_ENDPOINT_URL: ENC[AES256_GCM,data:9V0dljvWeFiG4bWAoUs0LSkztGgDIjaSyEaO+C0A4Cb1G1jj+xY=,iv:lnUyU+Vz4kD/VdhA7aKXXGXLcmnXuxkYJa/HT7jICEk=,tag:oafx5JSV20OHdFq5PaJVhQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaFNEREVhZmFJNkVxMDdz
-            S2hBSG9EQ2grVU1NNHNFcDRDN1ljUldodzA0CkhLOE5YSGNqWVRNbDNNR25yclho
-            bHJ3c0J0WVVSRHAycWFzSGt2Y2EyS2cKLS0tIFloSkF2YnRUZ25VRDF5NnFlR1Uz
-            eDFvS2d5S2lQNkJQZDhGY0YvU3FTTVEK0DhLUMtCwsz0hH5WCp1xTZ6sm06hL0cw
-            KVTiIt/vX6jbWTW3tr6hXdRkZkyXxfHqcY04pWKYIZG82l3DyTipuQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:39:08Z"
-    mac: ENC[AES256_GCM,data:DMasKoeAWIR4OHE2cHuYBVZgiEesh1NFraT9D1oqqWnnTyrLaBXSlC0f++g9fMjqba5+50mfgMvK5uimAcHhMVQQadhNrOYY821WcHbaRTPVJty12Ho/ahIaZVzxviQPeeWwh0biXIZdicYYY+jBnh/yXRlPgh0kv4BnuBIq39Y=,iv:/PjQPhfr29B9+rJxjYJfbItKjsmI++lIDVcWnwUTJtg=,tag:olnTGWGQaAE3IJNEy2zUrw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2