Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"

This reverts commit e7f3409d0f.

terraform/longhorn.tf

@@ -1,13 +1,25 @@
-# Longhorn StorageClasses — app-specific variants only.
-#
-# The cluster-wide default `longhorn` SC is intentionally NOT managed here.
-# It is owned by Longhorn's own setting-controller (reconciled from the
-# `longhorn-storageclass` ConfigMap in longhorn-system, stamped with the
-# `longhorn.io/last-applied-configmap` annotation). Managing it in Terraform
-# caused a dual-ownership fight: TF strips the annotation, Longhorn re-adds it
-# and delete+recreates the SC (params are immutable), racing TF's post-apply
-# read ("Root object present, but now absent"). Longhorn recreates it
-# automatically on any cluster, so it needs no TF representation.
+# Longhorn StorageClasses — cluster-wide default + app-specific variants
+# Imported from live cluster state (import-only, no delete)
+
+resource "kubernetes_storage_class" "longhorn" {
+  metadata {
+    name = "longhorn"
+  }
+  storage_provisioner    = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+  volume_binding_mode    = "Immediate"
+
+  parameters = {
+    numberOfReplicas          = "3"
+    staleReplicaTimeout       = "60"
+    fromBackup                = ""
+    fsType                    = "ext4"
+    dataLocality              = "disabled"
+    disableRevisionCounter    = "true"
+    unmapMarkSnapChainRemoved = "ignored"
+  }
+}
 
 resource "kubernetes_storage_class" "longhorn_kafka" {
   metadata {