Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"

This reverts commit e7f3409d0f.

terraform/minio.tf

@@ -3,11 +3,6 @@
 # Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
 # exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
 # no persistence.fsType, so fsType must be set on the StorageClass.
-#
-# PVC is Terraform-managed directly (import-only, prevent_destroy) and
-# referenced by the chart via persistence.existingClaim, so Helm never
-# templates/reconciles the PVC object itself (previously caused a failed
-# force-replace attempt against the bound, immutable volumeName).
 
 resource "kubernetes_storage_class" "longhorn_xfs" {
   metadata {
@@ -26,22 +21,6 @@ resource "kubernetes_storage_class" "longhorn_xfs" {
   }
 }
 
-resource "kubernetes_persistent_volume_claim" "minio" {
-  metadata {
-    name      = "minio"
-    namespace = "storage"
-  }
-  spec {
-    access_modes       = ["ReadWriteOnce"]
-    storage_class_name = kubernetes_storage_class.longhorn_xfs.metadata[0].name
-    resources {
-      requests = {
-        storage = "100Gi"
-      }
-    }
-  }
-}
-
 resource "helm_release" "minio" {
   name            = "minio"
   repository      = "https://charts.min.io/"
@@ -49,6 +28,7 @@ resource "helm_release" "minio" {
   version         = "5.4.0"
   namespace       = "storage"
   upgrade_install = true
+  force_update    = true
   wait            = true
   timeout         = 600
 
@@ -63,8 +43,10 @@ resource "helm_release" "minio" {
       rootPassword = var.minio_root_password
 
       persistence = {
-        enabled       = true
-        existingClaim = kubernetes_persistent_volume_claim.minio.metadata[0].name
+        enabled      = true
+        size         = "100Gi"
+        storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
+        accessMode   = "ReadWriteOnce"
       }
 
       resources = {