fix(argocd): repoURL http://forgejo.riotpiao.com:3000 -> https://forgejo.riotpiao.com

Root cause of widespread 'Unknown' sync status / Skipping auto-sync across
almost every Application: CoreDNS rewrites forgejo.riotpiao.com to the nginx
ingress controller service (rewrite name forgejo.riotpiao.com -> ingress-nginx-
controller...), which only listens on 80/443, not 3000. Every git fetch from
argocd-repo-server to the :3000 repoURL was timing out (context deadline
exceeded), so ArgoCD couldn't compare desired vs live state for any app.

Fix: use https://forgejo.riotpiao.com (no port, TLS via nginx + wildcard cert)
consistent with the 'all external endpoints HTTPS' requirement. Verified git
smart-http response 200 on the new URL before committing.

k8s/argocd/apps/05-networking.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/bootstrap/cilium
   destination:
@@ -31,7 +31,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/bootstrap/coredns
   destination: