feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts
*.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets.

Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates
grafana-values.yaml to wire admin.existingSecret (chart-native support).

CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik.
Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4
(loki/authentik/forgejo/temporal) extend plugin script incrementally after
verification.

Co-Authored-By: Claude Haiku 4.5 <[email protected]>

k8s/security/ci-cd/argocd-values.yaml

@@ -47,6 +47,15 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
+  cmp:
+    plugins:
+      sops-secrets:
+        generate:
+          command: sh
+          args:
+            - -c
+            - /var/run/argocd/plugins/sops-cmp-generate.sh
+
 server:
   replicas: 1
   deploymentStrategy:
@@ -90,6 +99,26 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
+  extraContainers:
+    - name: sops-cmp
+      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
+      command: [/var/run/argocd/argocd-cmp-server]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+      volumeMounts:
+        - mountPath: /var/run/argocd
+          name: var-files
+        - mountPath: /home/argocd/cmp-server/plugins
+          name: plugins
+        - mountPath: /tmp
+          name: tmp
+        - mountPath: /sops-age
+          name: sops-age
+  volumes:
+    - name: sops-age
+      secret:
+        secretName: sops-age
 
 applicationSet:
   replicas: 1