refactor(argocd): simplify secrets approach — use directory source, manual Secrets for Stage 0

Reverts complex CMP plugin setup (helm chart doesn't support repoServer.extraContainers).
Instead: sops-secrets Application uses directory source (no plugin), emits placeholder
README. Manually-created Secrets (grafana-admin) live in target namespaces.

Full CMP plugin work deferred to future stage. Grafana values still wired to
admin.existingSecret (no-op until Secret exists, which it now does).

This unblocks cluster deployment without waiting for ArgoCD CMP plumbing.

k8s/security/ci-cd/argocd-values.yaml

@@ -47,15 +47,6 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
-  cmp:
-    plugins:
-      sops-secrets:
-        generate:
-          command: sh
-          args:
-            - -c
-            - /var/run/argocd/plugins/sops-cmp-generate.sh
-
 server:
   replicas: 1
   deploymentStrategy:
@@ -99,26 +90,6 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
-  extraContainers:
-    - name: sops-cmp
-      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
-      command: [/var/run/argocd/argocd-cmp-server]
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
-      volumeMounts:
-        - mountPath: /var/run/argocd
-          name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
-        - mountPath: /tmp
-          name: tmp
-        - mountPath: /sops-age
-          name: sops-age
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
 
 applicationSet:
   replicas: 1