feat(substrate): deploy cert-manager, ingress-nginx, reloader + LE staging issuers via app-of-apps — restores substrate ownership after Terraform removal

Substrate had no owner since Terraform was deleted (Pure GitOps). Adds 5 wave-0/1
Applications: cert-manager v1.21.0 (installCRDs, CP tolerations), ingress-nginx
4.15.1 (LB 192.168.1.160), reloader 2.2.14 at wave 0; LE ClusterIssuers +
*.riotpiao.com wildcard cert at wave 1 (DNS-01 via Cloudflare). Adds 3 chart
repos to AppProject sourceRepos and SOPS-encrypted cloudflare-api-token secret.
Cert starts on letsencrypt-staging; flip to prod after clean issue.

k8s/argocd/projects/homelab-project.yaml

@@ -25,6 +25,10 @@ spec:
     - https://charts.bitnami.com/bitnami
     - https://go.temporal.io/helm-charts
     - https://portainer.github.io/k8s/
+    # Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned
+    - https://charts.jetstack.io
+    - https://kubernetes.github.io/ingress-nginx
+    - https://stakater.github.io/stakater-charts
   destinations:
     - server: https://kubernetes.default.svc
       namespace: "*"