feat(substrate): deploy cert-manager, ingress-nginx, reloader + LE staging issuers via app-of-apps — restores substrate ownership after Terraform removal

Substrate had no owner since Terraform was deleted (Pure GitOps). Adds 5 wave-0/1
Applications: cert-manager v1.21.0 (installCRDs, CP tolerations), ingress-nginx
4.15.1 (LB 192.168.1.160), reloader 2.2.14 at wave 0; LE ClusterIssuers +
*.riotpiao.com wildcard cert at wave 1 (DNS-01 via Cloudflare). Adds 3 chart
repos to AppProject sourceRepos and SOPS-encrypted cloudflare-api-token secret.
Cert starts on letsencrypt-staging; flip to prod after clean issue.

k8s/bootstrap/cert-manager/cert-manager-values.yaml

@@ -3,6 +3,32 @@
 # wildcard cert nginx serves — certmanager_certificate_expiration_timestamp_seconds
 # is the early-warning signal before any service's TLS breaks.
 
+# CRDs must be installed by the chart — ArgoCD helm-template does not apply a
+# chart's crds/ folder, and the ClusterIssuer/Certificate resources (wave 1)
+# depend on them existing first.
+installCRDs: true
+
+# Tolerate the control-plane taint (talos-cp-1 is the only schedulable node).
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+webhook:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+cainjector:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+startupapicheck:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
 prometheus:
   enabled: true
   servicemonitor: