feat(argocd): add portfolio app, explicit sourceRepos, coredns rewrite for riotpiao.com

- Add Application for rock/riotpiao.com repo (portfolio site)
- Replace wildcard sourceRepos with explicit repo list
- Add CoreDNS rewrite for root domain riotpiao.com

k8s/argocd/apps/60-applications.yaml

@@ -236,6 +236,32 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
+# Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
+# which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: portfolio
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/riotpiao.com.git
+    targetRevision: main
+    path: infra/portfolio/base
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: portfolio
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Wave 9 - per-service scoped RBAC (Role/RoleBinding), deliberately last so
 # every target namespace above already exists. Inert until kube-apiserver
 # gets --oidc-groups-claim=groups wired up (separate, not-yet-applied