stage1: A1-A2 AppProject and projects Application

A1: Replace per-repo Forgejo entries with https://forgejo.riotpiao.com/rock/*
    wildcard so onboarding never requires touching AppProject.

A2: Add wave -1 Application for k8s/argocd/projects/ so it syncs before
    any Application references the AppProject.

Also add kustomization.yaml to k8s/argocd/projects/ to make it renderable.

Enabled by Stage 1 (A1, A2).

k8s/argocd/apps/-1-projects.yaml

@@ -0,0 +1,25 @@
+# Wave -1 — AppProject definitions (must sync before any Application that references them).
+# Syncs k8s/argocd/projects/ which was previously applied by hand.
+# Enabled by Stage 1 (A2).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-projects
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  source:
+    repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
+    targetRevision: main
+    path: k8s/argocd/projects
+  destination:
+    server: https://kubernetes.default.svc

k8s/argocd/projects/homelab-project.yaml

@@ -12,9 +12,9 @@ spec:
   description: Homelab GitOps — single-repo, in-cluster destinations only
   sourceRepos:
     - https://github.com/Riotpiaole/riotpiao.homelab.com.git
-    # In-cluster Forgejo — api-gw (k8s/argocd/apps/55-api-gateway.yaml) sources
-    # rock/homelab-frontend from here.
-    - https://forgejo.riotpiao.com/rock/homelab-frontend.git
+    # In-cluster Forgejo wildcard — all rock/* repos can be onboarded without
+    # touching this AppProject. Enabled by Stage 1 (A1).
+    - https://forgejo.riotpiao.com/rock/*
     # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
     - https://cloudnative-pg.github.io/charts
     - https://dl.gitea.com/charts/

k8s/argocd/projects/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+metadata:
+  name: argocd-projects
+
+# AppProject definitions for ArgoCD. Synced by wave -1 Application
+# (k8s/argocd/apps/-1-projects.yaml) so they exist before any Application
+# references them. Enabled by Stage 1 (A2).
+resources:
+  - homelab-project.yaml