fix(argocd): repoURL http://forgejo.riotpiao.com:3000 -> https://forgejo.riotpiao.com

Root cause of widespread 'Unknown' sync status / Skipping auto-sync across
almost every Application: CoreDNS rewrites forgejo.riotpiao.com to the nginx
ingress controller service (rewrite name forgejo.riotpiao.com -> ingress-nginx-
controller...), which only listens on 80/443, not 3000. Every git fetch from
argocd-repo-server to the :3000 repoURL was timing out (context deadline
exceeded), so ArgoCD couldn't compare desired vs live state for any app.

Fix: use https://forgejo.riotpiao.com (no port, TLS via nginx + wildcard cert)
consistent with the 'all external endpoints HTTPS' requirement. Verified git
smart-http response 200 on the new URL before committing.

k8s/argocd/apps/30-security.yaml

@@ -17,7 +17,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/security/iam/vault-values.yaml
-    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -46,7 +46,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/security/iam/authentik-values.yaml
-    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -68,7 +68,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/security/iam
   destination:
@@ -90,7 +90,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/security/ci-cd/charts/forgejo-runner
   destination: