refactor(argocd): simplify secrets approach — use directory source, manual Secrets for Stage 0

Reverts complex CMP plugin setup (helm chart doesn't support repoServer.extraContainers).
Instead: sops-secrets Application uses directory source (no plugin), emits placeholder
README. Manually-created Secrets (grafana-admin) live in target namespaces.

Full CMP plugin work deferred to future stage. Grafana values still wired to
admin.existingSecret (no-op until Secret exists, which it now does).

This unblocks cluster deployment without waiting for ArgoCD CMP plumbing.

k8s/argocd/apps/00-secrets.yaml

@@ -20,7 +20,6 @@ spec:
     repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/security/sops-secrets
-    plugin: {}
+    directory: {}
   destination:
     server: https://kubernetes.default.svc
-  revisionHistoryLimit: 3